log sources coming in from UniversalForwarderto Heavyforwarder looking to selectively forward to syslog without indexing on the heavyforwarder or index cluster, these selective logs need to only forward to syslog central logging system only syslog output is working already on the heavyforwarder and indexing on the heavyforwarder is disabled, but events are being indexed on the index host/cluster, is there a configuration/deployment where HeavyForwarder selectively only forwarded to syslog without any indexing ?
... View more