Yes, indexers do process data before it gets indexed. That's the primary function of an indexer. A heavy forwarder is just an indexer that does not store data. Index-time settings must be deployed on the first one (HF or indexer) that sees the data. You're right to want to avoid an intermediate layer, IMO. As for how to modify the data, I think SEDCMD is easiest to do. Put this in the relevant props.conf file: [mysourcetype]
SEDCMD-stripFields = s/\[action:"(?<Action>\w+)"|origin:"(?<Origin>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"|layer_name:"(?<Text>\w+)"|dst:"(?<dest>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"|src:"(?<Source>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"/\1,\2,\3,\4,\5/ It will keep only the 5 capture groups, separated by commas.
... View more