[tcp-ssl://9515]
disabled=0
index = myindex
connection_host = ip
sourcetype = mysourcetype
_TCP_ROUTING = myindexcluster
The above will allow raw events and default fields to be put into the indexer.
The below allows indexed csv fields (structured) to be put into the indexer.
The props.conf entry for the sourcetype is used by both tcp and disk file input.
I am using identical csv files as data for each.
Why cannot the tcp ingested csv file be indexed by the forwarder and sent to the indexer?
[batch:///data/myfolder]
move_policy = sinkhole
disabled = 0
index= myindex
sourcetype = mysourcetype
crcSalt = <SOURCE>
recursive = false
_TCP_ROUTING = myindexcluster
