I release this is old but Universal Forwarders do perform EVENT_BREAKER properties.  It was brought in for 1. Better load balancing. 2. Line break tuning would be more efficient, E.G. multiple lines of the same event would not be sent to different indexers. See the props.conf.spec in the Universal forwarder for "EVENT_BREAKER" for more details. ... View more