I am currently forwarding logs from uf to HF to idx.
What I am trying to achieve is drop windows event with the event code 4674 for example from being sent to idx. At the same time, forward all the logs including the events with the event code 4674 to a 3rd party syslog server from the HF.
While configuring the HF, I found:
1) there is a delay in sending the logs to syslog server. I noticed that I received it roughly 15 minutes after the event time.
2) I configured the event code 4674 to send to nullqueue. By doing so, it dropped the event from being sent to idx. However, it is also not forwarding this event to the 3rd party syslog server. I need it only drop the events from being sent to idx. It has to send this event to the syslog server.