In our infra we collect the logs with paloalto, epo, proxy ..., everything works fine except the log collection of Palo Alto. we changed the queue module (queue.type = "LinkedList") and we moved to the direct queue (queue.type = "Direct") but it's not good enough. So we want to know if it fits or not or is it a problem of conf that we have not seen? -------------------------------------------------------------------------
