Hi,
For example, we have 2 universal forwarders
UF1 = web01abc23
UF2 = web01cde21
Both are having same inputs.conf as under an app called "app_all_web" and this app is pushed from deployment server.
Both of the UF are same having same monitoring stanza like
[monitor://xyz.log]
sourcetype=web_log
index=abc
But I would like to add tcp_routing attribute to monitoring stanza on UF2 like below.
[monitor://xyz.log]
sourcetype=web_log
index=abc
_TCP_ROUTING=HeavyForwarders_1
If make change in the app and push it, then it will be pushed to UF1 which I don't want because I want that change only on UF2.
My idea:
create an new app
blacklist UF2 on "app_all_web"
whitelist UF2 on new app (new app contains all the changes that i need)
I would like to get suggestions is it possible to do under same app without creating new app.
@kteng2024 I would suggest the approach of creating a new app and just add the attribute to it and send it to two different destinations :
web01abc23
App1
[monitor://xyz.log]
sourcetype=web_log
index=abc
web01cde21
app2
[monitor://xyz.log]
sourcetype=web_log
index=abc
_TCP_ROUTING=HeavyForwarders_1
Hope this helps.