Our heavy forwarder is forwarding logs to the Indexer. All the logs are going to the main Index. In the indexer level, is it possible to change Props.conf and /transforms.conf to send the logs to a different(alternate) index based on the Host? I put the below changes in the indexer conf files which is not working. Same config changes works from heavy forwarder, but I am having a different issue when I put it in the Heavy forwarder. From Heavy forwarder its duplicating the messages into both main and Newindex. So I am trying to put directly into indexer, which is not working 😞
TRANSFORMS = rewrite-DPindex
REGEX = .*
DEST_KEY = _MetaData:Index
FORMAT = NewIndex
at first, are you sure that ip address is the real hostname of the host that you want to redirect?
Anyway this configuration must be at Heavy Forwarder level.
In general, I suggest to manage this different index addressing at Universal Forwarder level, using Deployment Server and creating two ServerClasses: one for this host and one for the others.
Each serverClass has its own Technical Add-On with the correct index addressing.
So you don't need to override index definition and you haven'0t any duplication.