Creating an event router

The collector sends events to an event router in the data center, and the event router sends the events to the specified destinations: correlator and storage.

Preconditions:

• KUMA 3.2 collectors are configured at the branch offices.
• The data center has the capacity to install an event router.
• KUMA 3.2 is installed in the data center.

Steps:

1. In the data center:
   1. Create the Event router service.
   2. Create storage and correlator destination points and specify them in the Event router.
   3. In the Event router on the Advanced settings tab, configure a filter to send events to storage and/or correlator. For example, "DeviceCustomString = correlator" or "DeviceCustomString = storage".
   4. Configure enrichment.
2. In the collectors at branch offices:
   1. Create a destination of the eventRouter type.
   2. Specify the URL of the event router in the data center of the branch office.
   3. If eventRouter replaces previously configured destinations, you can delete them.

Postcondition:

• Collectors at the branch offices are configured.
• The event router in the data center is configured.

Connections of branch offices to the data center have been optimized: for each collector, you no longer need to configure events to be sent both to storage and to the correlator in the data center. This halves the load on the link.

Routing to the storage and the correlator is performed within the data center.

Multiple collectors send events to the event router at the branch office, and the event router at the branch office sends events to the router in the data center, where events are then sent to the specified destinations, that is, correlators and storage.

Preconditions:

• KUMA 3.2 collectors are configured at the branch offices.
• The data center has the capacity to install an event router.
• KUMA 3.2 is installed in the data center.

Steps:

1. In the data center:
   1. Create the Event router service.
   2. Create storage and correlator destination points and specify them in the Event router.
   3. In the Event router on the Advanced settings tab, configure a filter to send events to storage and/or correlator. For example, "DeviceCustomString = correlator" or "DeviceCustomString = storage".
2. At the branch office:
   1. Create the Event router service.
   2. Create a destination of the eventRouter type and specify the URL of the Event router in the data center.
3. In the collectors at branch offices:
   1. Create a destination of the eventRouter type and specify the URL of the Event router at the branch office.
   2. If eventRouter replaces previously configured destinations, you can delete them.

Postcondition:

1. Collectors at the branch offices are configured.
2. The event router in the data center and the event router at the branch office are configured.

The connections of branch offices with the data center are optimized: in each collector, you no longer need to configure events to be sent to the data center; it is enough to collect all events on the router and send it to the data center as one stream.