Can you configure a heavy forwarder to route raw data to a local file?

[Log_wrangler]

I need a capture some raw data before it is indexed and sent to a 3rd party application (via tcp_routing and transforms-routing)

I would like to send it to a local dir/file... is that possible?

Please advise...

Thank you

[FrankVl · Accepted solution]

Not that I’m aware of, at least not directly. What you could do as a workaround I guess is run a syslog daemon on that system as an intermediate. Send it to local host using syslog routing and then have the syslog daemon write it to file.

[Log_wrangler]

that's an option thanks