I want to setup a universal forwarder send events to a heavy forwarder (lots of events, with lots of parsing) and then to an indexer, where they will be stored.
My uf will have a inputs/outputs conf file, and my hf will have the same, plus a props/transforms .conf. How do I tell the hf not to index anything?
this is set per default this way, see the docs about outputs.conf:
indexAndForward = [true|false] * Index all data locally, in addition to forwarding it. * This is known as an "index-and-forward" configuration. * This attribute is only available for heavy forwarders. * This attribute is available only at the top level [tcpout] stanza. It cannot be overridden in a target group. * Defaults to false.
Thanks. On hfw inputs.conf, I setup the following, and I received possible typo messages for the transforms statement. Can't I do transforms at this level?
sourcetype = snmp_metrics
TRANSFORMS-set = setnull,setparsing,sethost