aab5272,
You do not need to have an intermediate forwarding layer to avoid the situation you present, if you in your outputs.conf file create a tcpout stanza like below
[tcpout]
defaultGroup = lb
[tcpout:lb]
server = 1.2.3.4:4433, 1.2.3.5:4433
If indexer #1 in data center #1 goes down, all of the data will be sent to #2, and the same in reverse.
You can add as many as you want here, best practice would be to configure this to send to all of your indexers, and then if one data center goes down the other one will get the data.
You can control search-ability and copies of your data by setting up multi-site indexer clustering. this will allow you to replicate data, as well as ensure search-ability should one data center go down.
The problem you create with out an index cluster is if data center one goes down, the data on the indexers located there is not searchable. creating incomplete results.
With a cluster, you can get all of the data you have indexed across both data centers.
... View more