Route Data based on Heavy Forwarder Host?

[ajiwanand]

We're approaching this from an MSSP standpoint.
We're looking at having an intermediate forwarder layer where we route data in a shared layer based on the client heavy forwarders.
Essentially it would go Client HF -> Intermediate Forwarder Layers Route based on host -> Client Indexer

Is this possible? I cant seem to get the props/transforms config to work

props.conf
[default]
TRANSFORMS-setrouting = tsthost-routing
TRANSFORMS-setrouting = abchost-routing

transforms.conf
[tsthost-routing]
SOURCE_KEY = MetaData:Host
REGEX = (hf1_tst)
DEST_KEY = _TCP_ROUTING
FORMAT = client-tst-lb-indexers

[abchost-routing]
SOURCE_KEY = MetaData:Host
REGEX = (hf1_abc)
DEST_KEY = _TCP_ROUTING
FORMAT = client-abc-lb-indexers

Im aware of potential parsing issues as well and well be evaluating that.

Thanks

[richgalloway]

if the client has dedicated indexers, why not have the client HF send directly to them using outputs.conf?

[ajiwanand]

Lots of reasons, mainly the deployment is hosted on AWS and getting push back from security for having an internet gateway, so we're trying to propose a separate VPC with an intermediate forwarding layer connected to the deployment VPCs over a private link.

[493669]

@ajiwanand Can you try including both transforms stanza in one-
props.conf

[default]
TRANSFORMS-setrouting = tsthost-routing, abchost-routing

[ajiwanand]

Nope, no luck. It still sends to both deployments. I asked on the slack group and they mentioned HF to Intermediate HF routing does not work unless you do some "hacks" and that it works for UF but not HF unsure if this is true as ive read documentation that seem to state its possible..