Using HEC vs Heavy Forwarder

[anurbhav]

Is there a clear list of pros and cons of using HEC vs Heavy forwarders

Also, are there any best practices or preferences of using these 2 options in a given setting

[arjunpkishore5]

Do you mean HEC vs File monitoring?

HEC can live on your Heavy Forwarder. 

With the assumption that you are looking for file monitoring vs HEC, you are looking at pull vs push processes, file monitor keeps monitoring a directory and pulls data when new files or updates to existing files are made. On the other hand, HEC listens on a port and you push data to it. Using one vs the other entirely depends on your use case. 

Unfortunately, without more context on what your end goal is, this is all the info I can provide.

[anurbhav]

My end goal is to ingest AWS cloud watch logs to SPLUNK

[Roy_9]

@anurbhav If you are going with the route of Kinesis-Cloudwatch-HEC-Splunk then i will prefer HEC.

[anurbhav]

If i need to ingest my AWS cloudwatch logs to splunk what are the pros and cons of HF vs HEC. What design considerations will it impacts

[richgalloway]

There are a lot of things to consider when choosing HF or HEC.  There is no documentation on the subject that I know of.  It really comes down to what you need to do.

HFs are good for monitoring files or directories and transforming data.

HEC is good for receiving data directly from an application.