topic Re: Route Data based on Heavy Forwarder Host? in Getting Data In

Route Data based on Heavy Forwarder Host?

ajiwanand — Wed, 30 Sep 2020 05:35:22 GMT

We're approaching this from an MSSP standpoint.
We're looking at having an intermediate forwarder layer where we route data in a shared layer based on the client heavy forwarders.
Essentially it would go Client HF -> Intermediate Forwarder Layers Route based on host -> Client Indexer

Is this possible? I cant seem to get the props/transforms config to work

props.conf
[default]
TRANSFORMS-setrouting = tsthost-routing
TRANSFORMS-setrouting = abchost-routing

transforms.conf
[tsthost-routing]
SOURCE_KEY = MetaData:Host
REGEX = (hf1_tst)
DEST_KEY = _TCP_ROUTING
FORMAT = client-tst-lb-indexers

[abchost-routing]
SOURCE_KEY = MetaData:Host
REGEX = (hf1_abc)
DEST_KEY = _TCP_ROUTING
FORMAT = client-abc-lb-indexers

Im aware of potential parsing issues as well and well be evaluating that.

Thanks

Re: Route Data based on Heavy Forwarder Host?

493669 — Tue, 02 Jun 2020 02:06:02 GMT

@ajiwanand Can you try including both transforms stanza in one-
props.conf

[default]
TRANSFORMS-setrouting = tsthost-routing, abchost-routing

Re: Route Data based on Heavy Forwarder Host?

ajiwanand — Tue, 02 Jun 2020 03:13:18 GMT

Nope, no luck. It still sends to both deployments. I asked on the slack group and they mentioned HF to Intermediate HF routing does not work unless you do some "hacks" and that it works for UF but not HF unsure if this is true as ive read documentation that seem to state its possible..

Re: Route Data based on Heavy Forwarder Host?

richgalloway — Tue, 02 Jun 2020 12:49:51 GMT

if the client has dedicated indexers, why not have the client HF send directly to them using outputs.conf?

Re: Route Data based on Heavy Forwarder Host?

ajiwanand — Tue, 02 Jun 2020 13:50:23 GMT

Lots of reasons, mainly the deployment is hosted on AWS and getting push back from security for having an internet gateway, so we're trying to propose a separate VPC with an intermediate forwarding layer connected to the deployment VPCs over a private link.