Forward filtered logs to indexer and full logs to third party syslog server

[archme]

Hello,

I am currently forwarding logs from uf to HF to idx.

What I am trying to achieve is drop windows event with the event code 4674 for example from being sent to idx. At the same time, forward all the logs including the events with the event code 4674 to a 3rd party syslog server from the HF.

While configuring the HF, I found:
1) there is a delay in sending the logs to syslog server. I noticed that I received it roughly 15 minutes after the event time.
2) I configured the event code 4674 to send to nullqueue. By doing so, it dropped the event from being sent to idx. However, it is also not forwarding this event to the 3rd party syslog server. I need it only drop the events from being sent to idx. It has to send this event to the syslog server.

Not sure what is wrong..hope someone can advise.

Below is my outputs.conf setting:

[tcpout]
defaultGroup = primary_indexers
[syslog]
defaultGroup = EverythingtoSSB
[syslog:EverythingtoSSB]
#sendCookedData=false
server=1.2.3.4:514
type=udp
maxEventSize=5096

Below is props.conf:

[WinEventLog:Security]
TRANSFORMS-set=wineventlog-setnull,routeAlltoSSB

Below is transforms.conf

[routeAlltoSSB]
REGEX=(.)
DEST_KEY=_SYSLOG_ROUTING
FORMAT=EverythingtoSSB

[wineventlog-setnull]
REGEX=(?m)^EventCode=(4674)
DEST_KEY = queue
FORMAT = nullQueue

[somesoni2]

Try this for your Below for transforms.conf

[routeAlltoSSB]
 REGEX=(.)
 DEST_KEY=_TCP_ROUTING
 FORMAT=EverythingtoSSB,primary_indexers

 [wineventlog-setnull]
 REGEX=(?m)^EventCode=(4674)
 DEST_KEY=_TCP_ROUTING
 FORMAT = EverythingtoSSB