How to forward an index to third party syslog using heavy forwarder

[michael_lee]

I have an index test_index collecting http logs and I want to forward to another syslog server. I have outputs.conf, props.conf and transform.conf as such:

1. outputs.conf

   [syslog]
   defaultGroup=syslogGroup
   type=tcp

   [syslog:syslogGroup]
   server = 192.168.22.101:514

   [tcpout]
   defaultGroup = raw_tcp_out
   forwardedindex.0.whitelist =
   forwardedindex.1.blacklist =
   forwardedindex.2.whitelist =
   indexAndForward = true
   sendCookedData = false
   forwardedindex.0.whitelist = test_index

   [tcpout:raw_tcp_out]
   server = 192.168.22.101:514

2. props.conf

   [host::192.168.22.101]
   TRANSFORMS-kiwi = send_to_syslog

3. transform.conf

   [send_to_syslog]
   REGEX = .
   DEST_KEY = _SYSLOG_ROUTING
   FORMAT = syslogGroup

When I check with the destination syslog server 192.168.22.101, it is logging a lot of events which are not from test_index. Is there anything wrong with config files ? I a using 6.3.3 latest Splunk heavy forwarder.
thanks

[lycollicott]

If you have already ingested and indexed the events...why are you syslogging them at all? You already have them in Splunk, the greatest software on the planet.

[ryandg]

In your outputs.conf why do you have multiple blank whitelists and blacklist?

[tcpout]
defaultGroup = raw_tcp_out
**forwardedindex.0.whitelist = 
forwardedindex.1.blacklist = 
forwardedindex.2.whitelist =** 
indexAndForward = true
sendCookedData = false
forwardedindex.0.whitelist = test_index

[michael_lee]

I have added something like this. Is this correct? First, I blacklist everything that I don't need to be forwarded. Then lastly the whitelist.

 forwardedindex.1.blacklist = _*
 forwardedindex.2.blacklist = main
 forwardedindex.0.whitelist = my_index_to_forward

[ryandg]

try removing the blacklists and just having the whitelist. It's redundant to do a whitelist and a blacklist.