We are trying to configure a heavy forwarder to route some of the data to syslog+nullqueue, and index the rest of the data.
I tried to use props + transforms to route the desired regex to syslog+null queue.
Issue is, when events go to nullqueue, they do not go to syslog at all.
Is there any way to send to syslog while not indexing?
Here is what I configured in props.conf, transforms.conf:
Regex to route to syslog: *INFO
All the other events should be indexed.
Your configuration may need to vary slightly. Perhaps you want specific events sent to syslog, others indexed, etc. I recommend that you read the docs very carefully and test before implementing in production if possible: