Getting Data In

How to configure a heavy forwarder to route some of the data to syslogNG+Nullqueue

DynaJimLin
Engager

I am trying to configure a heavy forwarder to route all of data to SyslogNG while route some data to null queue.

I need my data flow as below:

For Data Archive: HF -> all of data -> SyslogNG
For Daily Search: HF -> NullQueue -> Indexer

My issue is, when logs go to nullqueue, they do not go to syslogNG at all.
Is there any way to send to syslog while not indexing?

Also, I can not use these in inputs.conf:

SYSLOG_ROUTING = primarySyslogs
_TCP_ROUTING = somethingThatDoesntExistInOutputsConf

The reason is I use checkpoint lea app to get data, this app do not need to config regular inputs.conf.

Here is what I configured in props.conf, transforms.conf:

props.conf
[opsec]
TRANSFORMS-route = RouteToNG, RouteToNullQueue

transforms.conf
[RouteToNG]
REGEX = .
DEST_KEY = _SYSLOG_ROUTING
FORMAT = syslogNG

[RouteToNullQueue]
REGEX = action=accept
DEST_KEY = queue
FORMAT = nullQueue

outputs.conf
[tcpout]
defaultGroup = default-autolb-group

[tcpout-server://indexer:9997]

[tcpout:default-autolb-group]
disabled = false
server = indexer:9997

[syslog:syslogNG]
server = x.x.x.x:514

0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi DynaJimLin,
I know that this isn't a direct solution to your problem but a workaround: did you explored the choice to send all data to SyslogNG and Indexer and then, on Indexer, filter them?
Bye.
Giuseppe

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi DynaJimLin,
I know that this isn't a direct solution to your problem but a workaround: did you explored the choice to send all data to SyslogNG and Indexer and then, on Indexer, filter them?
Bye.
Giuseppe

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

I'm curious as to why you have your HF in front of syslog-ng. The more common configuration is to write to syslog first (letting it filter as it needs to) and let a forwarder to pick up the events from there.
It is not possible to route events anywhere after nullQueue. nullQueue is a dead end - any events sent there are discarded.

---
If this reply helps you, an upvote would be appreciated.
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!