topic Re: configuring a pass-through in Getting Data In

configuring a pass-through

a212830 — Wed, 12 Mar 2014 01:52:38 GMT

Hi,

I want to setup a universal forwarder send events to a heavy forwarder (lots of events, with lots of parsing) and then to an indexer, where they will be stored.

My uf will have a inputs/outputs conf file, and my hf will have the same, plus a props/transforms .conf. How do I tell the hf not to index anything?

Re: configuring a pass-through

MuS — Wed, 12 Mar 2014 06:48:01 GMT

Hi a212830,

this is set per default this way, see the docs about outputs.conf:

indexAndForward = [true|false]
* Index all data locally, in addition to forwarding it.
* This is known as an "index-and-forward" configuration.
* This attribute is only available for heavy forwarders.
* This attribute is available only at the top level [tcpout] stanza. It cannot be overridden in a target group.
* Defaults to false.

cheers, MuS

Re: configuring a pass-through

a212830 — Wed, 12 Mar 2014 12:51:25 GMT

Thanks. On hfw inputs.conf, I setup the following, and I received possible typo messages for the transforms statement. Can't I do transforms at this level?

[tcp://:19997]
sourcetype = snmp_metrics
TRANSFORMS-set = setnull,setparsing,sethost

Re: configuring a pass-through

MuS — Thu, 13 Mar 2014 13:58:45 GMT

no this must be done in props.conf not in inputs.conf

Re: configuring a pass-through

a212830 — Fri, 14 Mar 2014 18:04:56 GMT

Why would a sourcetype be set in props.conf?

Re: configuring a pass-through

MuS — Mon, 17 Mar 2014 06:27:30 GMT

you asked for transforms and the answer for this is, no