Have the same indexed fields in logger and ESM

[victormanuel1]

It would be good practice, to have the same fields indexed in logger and ESM. With the evolution that ArcSight will this change?

[toor · Accepted solution]

Yes, that will change as both products will be changed in the future in regards to how they store their events. Logger will be merged together with RECON which as of today already uses the new unified data lake solution underneath.

ESM as well will be changed in the way it stores data and be using the unified data lake in future versions. While we are seeing this as a fairly complex change to the heart of ESMs architecture, we still target July for that to happen (but this is ideal and might change).