We have some external third-party managed systems whose logs should be indexed using Universal Forwarder. As we do not have exclusive control over its configuration we need to ensure that those Forwarders don't add data to a wrong index. So we want to restrict them to some allowed indices.
Unfortunately I couldn't find any solution for this up to now. So how could this be achieved?
As @gcusello said the easiest way is to manage this with DS if you manage those in central place. If not then the only option is to use props.conf to ensure that those UFs use correct indexes and actually chances those based on events which they are sending.