I'm trying to disactivate all index for forwaring, and only forward those on the white list, but it doesn't work.
My output.conf
[tcpout]
disabled = false
indexAndForward = false
defaultGroup = shared_indexers
forwardedindex.filter.disable = false
forwardedindex.0.blacklist = .*
forwardedindex.1.whitelist = test
[tcpout:shared_indexers]
disabled = false
autoLB = true
server = ....
Her my default/output.conf
# Version 5.0.6
[tcpout]
maxQueueSize = auto
forwardedindex.0.whitelist = .*
forwardedindex.1.blacklist = _.*
#forwardedindex.2.whitelist = (_audit|_internal)
forwardedindex.filter.disable = false
indexAndForward = false
autoLBFrequency = 30
blockOnCloning = true
compressed = false
disabled = false
dropClonedEventsOnQueueFull = 5
dropEventsOnQueueFull = -1
heartbeatFrequency = 30
maxFailuresPerInterval = 2
secsInFailureInterval = 1
maxConnectionsPerIndexer = 2
forceTimebasedAutoLB = false
sendCookedData = true
connectionTimeout = 20
readTimeout = 300
writeTimeout = 300
useACK = false
Although I don't see it in the manual, I thought that the forwardedindex
settings only worked if indexAndForward=true
Is there another way to only forward on index, then ?