Here is one thought. Can you install a Universal Forwarder on KIWI? If you set up an Input with stanzas for each sourcetype then you can output it to your indexes as needed.
Input: Example only
[monitor:///opt/log/cisco_router1/cisco_ironport_web.log]
sourcetype = cisco
index = web
host = cisco_router1
Output: Example only. these ips are both Indexer IPs
[tcpout:primary_indexers]
server = 10.0.10.2:9997,10.0.10.3:9997
... View more