forwarding data to another third-party system using Heavy Forwarder

KhalidAlharthi — Mon, 10 Jun 2024 06:34:07 GMT

Hello Community,

I wondering that i forward the logs using syslog instead of TCP, I received the packets using TcpDump and everything is good but the data not showing there and it's transferred using tcpdump....

that's my configuration in HF

Outputs.conf

[syslog]
defaultGroup = group2

[syslog:remote_siem]
server = xx.xx.xx.xx:514
sendCookedData = false

transforms.conf

[send_tmds_to_remote_siem]
REGEX = .
SOURCE_KEY = _MetaData:Index
DEST_KEY = _SYSLOG_ROUTING
FORMAT = remote_siem

[send_tmao_to_remote_siem]
REGEX = .
SOURCE_KEY = _MetaData:Index
DEST_KEY = _SYSLOG_ROUTING
FORMAT = remote_siem

props.conf

[source::udp:1518]
TRANSFORMS-send_tmds_to_remote_siem = send_tmds_to_remote_siem

[source::udp:1517]
TRANSFORMS-send_tmao_to_remote_siem = send_tmao_to_remote_siem

is it fine or something not correct please help .

topic forwarding data to another third-party system using Heavy Forwarder in Getting Data In

forwarding data to another third-party system using Heavy Forwarder