The recommended approach is to send Syslog messages to a syslog receiver like syslog-ng. The syslog receiver will write the events to file, and then you use a forwarder to collect the results from file, and send to your indexers. This breaks the "real-time" dependency for syslog, and means that you can tolerate network disruption between the UF-indexers, rather than risk loosing syslog messages in flight. ... View more