Why am I experiencing this unexpected behavior on HEC with index/indexes setting on HF?

[carlo_reiffers]

hi community

i'd like to

i tried to limit a HEC input to a certain index

i have observed unexpected behavior in several cases.

the configuration on the heavy forwarder goes a follows

[http://hec_instance]
description = HEC input for customer1
disabled = 0
index = customer1
indexes = [customer1]
token = XXXXXXXX

i am loading test events in json format using curl

case 1)  the  destination index is specified correctly in the metadata 

curl -k "https://hfhost:8088/services/collector/event" -H "Authorization: Splunk XXXXXXXX" -d '{"event": "Hello, world!", "sourcetype": "cool-fields", "index": "customer1", "fields": {"device": "macbook", "users": ["joe", "bob"]}}'

observed outcome:

event ends up in the correct index => expected behavior

case 2) the destination index specified in the metadata does not exist on the indexer cluster

curl -k "https://hfhost:8088/services/collector/event" -H "Authorization: Splunk XXXXXXXX" -d '{"event": "Hello, world!", "sourcetype": "cool-fields", "index": "customer2", "fields": {"device": "macbook", "users": ["joe", "bob"]}}'

observed outcome: 

events end up nowhere,

the HF does not bother, sends return code 0 as if everything was fine

the indexer (not the HF) creates a message that there were incoming events for a non existing index

=> not  expected behavior

case 3) the destination index is specified in the metadata, it is an existing index but it is not specified in the 'indexes' list for this HEC definition

 curl -k "https://hfhost:8088/services/collector/event" -H "Authorization: Splunk XXXXXXXX" -d '{"event": "Hello, world!", "sourcetype": "cool-fields", "index": "main", "fields": {"device": "macbook", "users": ["joe", "bob"]}}'

observed outcome: 

no error is generated

event is send to the 'main' index

=> not expected behavior

case 4) the destination index is not specified in the metadata
curl -k "https://hfhost:8088/services/collector/event" -H "Authorization: Splunk XXXXXXXX" -d '{"event": "Hello, world!", "sourcetype": "cool-fields", "fields": {"device": "macbook", "users": ["joe", "bob"]}}'

no error is generated

event is send to the 'main' index

=> not expected behavior

has someone observed this before?

is there something stupid in my setup that i fail to see?

additional info:

the  HF is running  splunk 8.2.2

the indexers are clustered an configured via cluster manager

thanks in advance for any info putting light into this

regards

Carlo