Hi R.Ismo, Thanks for the reply. The error message is from the indexer. As per the error message, the size of the incoming message is 369296128  bytes that turn around 352 MB. SSL is working fine as we have logs from the other data sources coming to indexers through the same UF.  This is the first time we are trying to inboard the Syslogs using TCP port.    Thanks, Kundan ... View more

Hi I’m not sure if this is valid for your environment, but there is bug for showing new indexes without restart before 8.0.2. It has occurred in one of our managed environment before we update it to use volumes. After that it disappears. You seems to use FS on test and volume on prod. And as other already said you must use repFactor = auto with clustering.  r. Ismo   ... View more

Faced exactly the same issue. Issue resolved after adding "repFactor = auto" in test though in production everything is working fine without "repFactor = auto".   ... View more