Syslog segregation and how pasing works when it is a syslog?

[praburam]

Is it possible to segregate the logs by redirecting everything to the routers via Syslog(other server Syslog to router log), then on the router(CentOS server) installing a light weight forwarder or a Heavy forwarder based on the load and bandwidth and get the logs to the Indexer.

If it is possible, how to Parse the data based on Hosts?

[MarioM]

Actually the easiest is to filter host on the TCP or UDP directly in your inputs.conf,but make sure there is no inputs.conf for the port you will use (ie no [udp://514] or [tcp://514] stanza):

[udp://10.1.7.230:514]
sourcetype = my-sourcetype

[udp://10.1.7.232:514]
sourcetype = my-sourcetype

OR

[tcp://10.1.8.28:514]
sourcetype = my-sourcetype2

[tcp://10.1.8.30:514]
sourcetype = my-sourcetype2