I want to build my Splunk environment in a "Cluster configuration mode":
I want to send data from the universal forwarder to the Cluster master, and from there to my indexers.
My main target is to collect logs from different application servers [by sending me syslog or http] in order to monitor their status: I want to create a unique index for each app: for example, the logs that are sent from an app called app1 will go into an index called "index_app1"
I believe by "cluster configuration mode" you are referring to the "indexer cluster" and and "indexer discovery" features of Splunk. An indexer cluster enables indexers to hold backup copies of each other's data in case of the failure of an indexer. Indexer Discovery is where servers with data to send to an indexer consult the Cluster Master (CM) to find out which indexer to use.
In no case does data flow through the CM. The Cluster Master is a manager, not a conduit.
Apps that send data in syslog or HTTP format should not be talking to a universal forwarder as a UF understands neither protocol.
For syslog, the apps should be sending to a dedicated syslog server which saves the data to disk files. The UF then monitors those disk files and sends the data to indexers. Alternatively, you could use the Splunk Connect for Syslog product to collect syslog data and forward it directly to the indexers.
For HTTP, apps should send to a heavy forwarder (HF) with HTTP Event Collector (HEC) enabled. Another option is to enable HEC on your indexers and use a load balancer to distribute the events evenly among the indexers.
It adds no value to prefix index names with "index_".
To answer your questions:
1) The CM does not know about universal forwarders. That's the job of the Monitoring Console and, optionally, the Deployment Server.
Anyway, to better understand your question, it better to divide them in three parts:
how to configure and deploy configurations to Universal Forwarders;
how to take logs;
how to send logs to Indexers' Cluster.
installation and upgrade isn't managed (for now, but it's changing!) by Splunk, so you have to do this manually.
Configurations checking and pushing is managed by a dedicated server called Deployment Server: in a lab you can also share this role with another server (not Master Node, Indexers and Search Heads), but in a production environment (more than 50 target servers) you have to use a dedicated server.
if instead you have to take syslogs, you can copy them on filesystem and read them as the precious point; if instead you want to directly take syslogs, you cannot use a Universal Forwarder, but you have to use an Heavy Forwarder (a full Splunk instance where all the logs are forwarded to Indexers), and follow the instructions at https://docs.splunk.com/Documentation/Splunk/8.0.5/Data/Monitornetworkports