This allows outputs events by server and allows us to keep this data separated into different files for events coming from different servers.
We have tried some other permutations:
a. Removing the defaultGroup
This removed the ForwarderInfo messages, but added audit log messages, which were more frequent
b. Remove the defaultGroup and add whitelist and blacklist to the tcpout stanza