How to blacklist server from heavy forwarder?

[YungLee]

Currently my Heavy Forwarder is receiving unwanted logs from a lot of different devices, and it is taking up a lot of space.

Is there a way to prevent / reject logs from all servers, and manually add server logs that we want to monitor into whitelist, so that it doesn't take up free space in my Heavy Forwarder.

So basically, reject all logs from all server.

Accept logs only from server1 and server2. 

Thank you in advance.

[SanjayReddy]

Hi @YungLee 

you can use 

acceptFrom in inputs.conf  of HF to allow data from specfic hosts 

SanjayReddy_0-1676022173478.png

[YungLee]

Hi @SanjayReddy ,

Thank you for your reply.

Just a additional question.

Does using the above configuration mean that the syslog will not enter or be stored in the Heavy Forwarder Linux machine's /var/log?

Thank you.