Is there a way to use the IP address of the indexer on the universal forwarder but have the name of the host displayed on the indexer ??
Here is my configuration :
defaultGroup = indexer-group
maxQueueSize = auto
server = 220.127.116.11:9997
Meaning that on my index it would show "prod-log-server" (the hostname) instead of 18.104.22.168
The indexer address used in outputs.conf is unrelated to any hosts set in inputs.conf (or overridden in transforms.conf... so yes, there is a way - nothing's in your way in fact.