Should we use heavy forwarders as an intermediate layer between the forwarders and the indexers?

[danielbb]

We had this severe issue last week - What can be done when the parsing and aggregation queues are filled up?

Since it took us days to figure it out and the entire indexer cluster was compromised and it took 11 hours with Support on the line to detect it, I wonder whether in general an heavy forwarder layer is a good idea.

[mydog8it]

What problem are you trying to solve by adding a heavy forwarder environment?

[danielbb]

Reducing load on the indexers and isolating issues as I pointed to in the question...

[gcusello]

Hi @danielbb,
I use HFs only when I need them (separated networks or syslogs), if I can I prefer to directly send logs from UFs to Indexers.

Maybe you should understand (with Support help) why you had the above problem, I don't think that an additional HF's layer could solve your problem, probably it could generate more queue problems.

Ciao.
Giuseppe