I want `HF` to forward specific logs(tcp input from 514 port) to indexer, and also transfer them itself with syslog format.
By the way, I configured like below, but its not working.
`props.conf`
[source::tcp:514]
TRANSFORMS-out = tcp_output, syslog_output
`transforms.conf`
[tcp_output]
REGEX = .
DEST_KEY = _TCP_ROUTING
FORMAT = tcp_output
[syslog_output]
REGEX = .
DEST_KEY = _SYSLOG_ROUTING
FORMAT = syslog_output
`outputs.conf`
[tcpout:tcp_output]
server=:9997
sendCookedData=false
[syslog:syslog_output]
server=localhost:10514
sendCookedData=false
Are these settings wrong?
If someone can tell me about it, I really appreciate it.
↧