Why is the Universal Forwarder indexing its own logs?

[wvalente]

Guys.

I have many Universal Forwarders installed in the machines that send logs to one Heavy Forwarder.

This Heavy Forwarder sends log to my indexer.

I do not know why each universal forwarder is sending its own internal logs (splunkd, metrics, etc) and indexing this data. I do not want the internal logs from each universal forwarder.

I've tried to filter these logs in the heavy forwarder, but it's not working.

What can I do?

Thanks.

[bcyates]

It is best practice to index _internal logs. Your Distributed Monitoring Console won't fully work without it and you won't really be able to remotely troubleshoot any problems on your UFs.

If you are worried about the amount of data in the index, just adjust frozenTimePeriodinSecs on those indexes so you don't hang on to them for too long

[FrankVl]

You can disable those inputs on the Universal Forwarder.

But usually these internal logs are considered very useful for monitoring the health of those instances and troubleshooting issues with data feeds, so I would highly recommend keeping them enabled actually.

Also: since this is going into _internal index, this is not counting against your license (if that is what you were worried about).