Can we change index in the indexer?

[roysoman]

Our heavy forwarder is forwarding logs to the Indexer. All the logs are going to the main Index. In the indexer level, is it possible to change Props.conf and /transforms.conf to send the logs to a different(alternate) index based on the Host? I put the below changes in the indexer conf files which is not working. Same config changes works from heavy forwarder, but I am having a different issue when I put it in the Heavy forwarder. From Heavy forwarder its duplicating the messages into both main and Newindex. So I am trying to put directly into indexer, which is not working 😞

in props.conf

[host::(IPaddress]
TRANSFORMS = rewrite-DPindex

in transforms.conf

[rewrite-DPindex]
REGEX = .*
DEST_KEY = _MetaData:Index
FORMAT = NewIndex

[gcusello]

Hi roysoman,
at first, are you sure that ip address is the real hostname of the host that you want to redirect?
Anyway this configuration must be at Heavy Forwarder level.

In general, I suggest to manage this different index addressing at Universal Forwarder level, using Deployment Server and creating two ServerClasses: one for this host and one for the others.
Each serverClass has its own Technical Add-On with the correct index addressing.
So you don't need to override index definition and you haven'0t any duplication.

Bye.
Giuseppe