Working on better alerting on indexing volume/license usage and the like and I've stumbled across something in-explicable. We have 4 Heavy Forwarders that all have default/outputs.conf with `[tcpout] indexAndForward = false`
Now when I look at:
index=_internal host=
↧