We have a search head, reporting search head, and a deployment server. I have them configured to send their internal data to our indexers.
The issue we have is that send some, but not all _internal data.
-reporting search head & search head do not forward their metrics.log file
-deployment server is running the deployment monitor app. When configured to forward all it's data to the indexers, it will send enough information to the indexers so that we can use the 'all forwarders' dashboard, but none of the source or sourcetype information is sent to the indexers.