As @sobrien noted, a forwarder on a consolidated syslog server would be the way to go. One suggestion as well would be to have a heavy forwarder in the mix too - either as the syslog server or a 'relay' from a syslog server with a universal forwarder on it, forwarding to/through a heavy forwarder. The idea is a heavy forwarder can then allow you to perform all the advanced functionality such as transforms, masking, etc. so that you can limit the amount of stuff you are sending into your indexers to only the stuff that has value for your enterprise (reducing the amount you index against your license), mask security specific fields that might need to be obfuscated, etc. It also would allow a single (or fewer) holes that you have to poke through your outbound firewall(s). ... View more