**Greetings!**
Is it possible to define index=myindex only on Heavy Forwarder to forward events from Universal Forwarder without having index=myindex definition on source system?
Like: **Source file** -> read by **Universal Forwarder** --> send to **Heavy Forwarde**r, tcp/9999 --> forwarded to I**ndexers/specifically index=myindex.**
I do not want to use deployment structures either, just plain Universal Forwarder reading local logs and pushing to defined port on heavy forwarder.
My goal is to hide/make heavy forwarder as decision point for inpuouring data. I know I can recieve data easily on that Heavy Forwader, but I do not know how to forward that specific input (say port 9999/tcp) to indexers and to SPECIFIC index. I do not need any special transforms or routing by content, just recieve-forward pair to make data moving and no (well, very little) configuration on source side.
It looks like it is easy to recieve data on Heavy Forwarder and as indexers are defined, the data will go to main index - but I want that data to go index=myindex residing on separate server.
Anyone done this?
↧