I would like to add one intermediate Forwarder between UF(Universal Forwarder) and 2 indexer.
For ex: i want event 1 to go from UF 1,2,3 to index Example in indexer 1, and event 2 from UF 2,3 to index Example 2 in indexer 2.
Normally, i can configure if UFs and indexers are connected directly by using output.conf in each UF. But if there is intermediate Forwarder, how can i configure that forwarder will do all the same things i said ?
Can you give me one example for that ?
(i don't want to use AutoBL and my intermediate Forwarder is heavy Forwarder)