heavy forwarder is intermediate component between universal and indexer components. its eliminate the garbage data and its do index routing, masking the data and sourcetype routing before going to indexer. for this purpose we have to use props.conf and transforms.conf files.
in transforms.conf we have to set the rules and in props.conf what is rule and to whom to apply.
,
... View more