Hi,
I want to setup a universal forwarder send events to a heavy forwarder (lots of events, with lots of parsing) and then to an indexer, where they will be stored.
My uf will have a inputs/outputs conf file, and my hf will have the same, plus a props/transforms .conf. How do I tell the hf not to index anything?
Hi a212830,
this is set per default this way, see the docs about outputs.conf:
indexAndForward = [true|false]
* Index all data locally, in addition to forwarding it.
* This is known as an "index-and-forward" configuration.
* This attribute is only available for heavy forwarders.
* This attribute is available only at the top level [tcpout] stanza. It cannot be overridden in a target group.
* Defaults to false.
cheers, MuS
you asked for transforms
and the answer for this is, no
Why would a sourcetype be set in props.conf?
no this must be done in props.conf not in inputs.conf
Thanks. On hfw inputs.conf, I setup the following, and I received possible typo messages for the transforms statement. Can't I do transforms at this level?
[tcp://:19997]
sourcetype = snmp_metrics
TRANSFORMS-set = setnull,setparsing,sethost