How to configure a heavy forwarder to route some of the data to syslogNG+Nullqueue?

[DynaJimLin]

I am trying to configure a heavy forwarder to route all of data to SyslogNG while route some data to null queue.

I need my data flow as below:

For Data Archive: HF -> all of data -> SyslogNG
For Daily Search: HF -> NullQueue -> Indexer

My issue is, when logs go to nullqueue, they do not go to syslogNG at all.
Is there any way to send to syslog while not indexing?

Also, I can not use these in inputs.conf:

SYSLOG_ROUTING = primarySyslogs
_TCP_ROUTING = somethingThatDoesntExistInOutputsConf

The reason is I use checkpoint lea app to get data, this app do not need to config regular inputs.conf.

Here is what I configured in props.conf, transforms.conf:

props.conf
[opsec]
TRANSFORMS-route = RouteToNG, RouteToNullQueue

transforms.conf
[RouteToNG]
REGEX = .
DEST_KEY = _SYSLOG_ROUTING
FORMAT = syslogNG

[RouteToNullQueue]
REGEX = action=accept
DEST_KEY = queue
FORMAT = nullQueue

outputs.conf
[tcpout]
defaultGroup = default-autolb-group

[tcpout-server://indexer:9997]

[tcpout:default-autolb-group]
disabled = false
server = indexer:9997

[syslog:syslogNG]
server = x.x.x.x:514

[gcusello · Accepted solution]

Hi DynaJimLin,
I know that this isn't a direct solution to your problem but a workaround: did you explored the choice to send all data to SyslogNG and Indexer and then, on Indexer, filter them?
Bye.
Giuseppe

[gcusello]

Hi @DynaJimLin ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉

[richgalloway]

I'm curious as to why you have your HF in front of syslog-ng. The more common configuration is to write to syslog first (letting it filter as it needs to) and let a forwarder to pick up the events from there.
It is not possible to route events anywhere after nullQueue. nullQueue is a dead end - any events sent there are discarded.