I would like to know the duty of the heavy forwarder and Indexer.
My inputs is syslog data which is read by heavy forwarder. I had set props.conf, transforms.conf in heavy forwarder itself also in outputs.conf I set the attribute ,
indexAndForward = true
this will index the data locally and forward parsed data to my indexer. What will my indexer do ? Will it just receive the indexed data and store in it mentioned index ?
What is the effect of mentioning my props.conf , transforms.conf in my indexer also?
My intension of using Heavy forwarder is to temporarily store the data and forward ,in case if my indexer is down or not-reachabale by forwarder.
Please clarify what is the exact conf files i need to concentrate