Why are we unable to send logs for HF to 2 indexes?

[Maurice68]

Hello. 

I'm trying to send log from heavy forwarder to 2 indexes. One is receiving logs, but the second is not.

Here is the props.conf file:

[test]
TRANSFORMS-routing=errorRouting,successRouting

Here is the outputs.conf file:

[tcpout:errorGroup]
server = 35.196.124.233:9997

[tcpout:successGroup]
server = 34.138.8.216:9997

Here is the transforms.conf file:

[errorRouting]
REGEX=.
DEST_KEY=_TCP_ROUTING
FORMAT=errorGroup

[successRouting]
REGEX=.
DEST_KEY=_TCP_ROUTING
FORMAT=successGroup

What could be the problem?

[Maurice68]

Thank you.

[PickleRick]

1. You're not trying to route to two indexes but to two indexers.

2. If you want the event to be sent to both those groups, you're gonna have to clone the event (maybe you can do it easier with ingest action). With your configuration the second transform overwrites the result of the first one so all your events will go to successGroup.