I want to use forwarder to forward mail logs to indexer.
However, the log forwarded from the forwarder is displayed separately from the indexer.
how can i solve it.
start character: MAILLOG
end character: ENDMAIL
The log is divided.
ex1) only mail start characters logs.
ex2) only part of the message logs.
Please explain more about what you mean by "the log forwarded from the forwarder is displayed separately from the indexer". Use actual example events, but hide private information.
Your props.conf settings probably need to be adjusted. Please provide some sample events and we'll try to help you get the settings right.