Modify the order in which routing filters are evaluated for log ingestion into indexed or non-indexed partitions. Routing filters for non-indexed partitions are evaluated first, followed by indexed partitions. The default indexed partition is always the last partition into which logs are ingested, if no other routing filter matches.

Prerequisites

Verify that you have a premium or a trial subscription for VMware Aria Operations for Logs (SaaS).
  • If you have a trial subscription, you must activate log partitions before using the subscription. To activate partitions, go to Log Management > Log Partitions and click Enable Partitions.
  • If you have a free subscription, you cannot use log partitions.
  • If you have a premium subscription, log partitions are available by default, and you do not have to activate the feature.
For information about subscriptions, see VMware Aria Operations for Logs (SaaS) Subscriptions and Billing.

Procedure

  1. Click the two arrows icon in the upper-left corner of the screen to expand the main menu.
  2. Navigate to Log Management > Log Partitions.
  3. Click Ingestion Order and then click Indexed Partitions or Non-Indexed Partitions.
  4. Click a partition and drag it to the position that you want.
    Note: You cannot modify the ingestion order of a decommissioned partition.
  5. Click Save.