We also support nested event fields, as shown in this example. { "summary": "Backup policy '{{data.config.name}}' was {{data.config.action}} by {{actor.identifier}}", "workload": "{{data.workload.type}}", "tenantId": "{{data.tenant.id}}", "policyId": "{{data.policy.id}}", "policyType": "{{data.policy.type}}", "status": "{{data.config.status}}", "schedule": "{{data.config.schedule}}", "retention": "{{data.config.retention}}", "occurredAt": "{{timestamp}}", "rawEvent": {{event}} }

event will be sent like: { "summary": "Backup policy 'Daily Exchange Backup' was UPDATED by admin@contoso.com", "workload": "M365", "tenantId": "tenant_12345", "policyId": "policy_12345", "policyType": "Exchange Mailboxes", "status": "ENABLED", "schedule": "daily at 02:00 UTC", "retention": "90 days", "occurredAt": "2026-07-13T09:30:00Z", "rawEvent": { ...the full event JSON from above... } }

I would add this kind of exsamples.

I don not see this option on UI

nest group nodes are not supported

To me, this is a flat list of conditions combined with OR/AND logic. This is not a tree.

Veeam Data Cloud forwards raw events.

To avoid unexpected behavior, customers should ensure that their rules do not overlap.

If you do not add any rules, Veeam Data Cloud forwards raw events.

If you do not add any rules, Veeam Data Cloud forwards raw events.

The event will be sent in raw format, not in LogScale format. This is properly described in the "Adding Splunk Integrations" section.