Hi, If I recall correctly at HEC token creation do not select any index , use  local/context/splunk_metadata.csv for that. I think that fixed it. Daniel ... View more

Hi, Thank you for your aswer. I'm trying to prevent SC4S to send via HEC syslog-ng logs, metrics and any other traffic besides the actual logs becase we have a low ressources environment. In /opt/sc4s/local/config/destinations/block_me.conf: destination d_block_metrics { file("/dev/null"); }; And in /opt/sc4s/local/config/log_paths/block_me.conf: log { source(s_internal); source(s_system); #destination(d_hec_debug); destination(d_block_metrics); flags(final); }; I guess I'm doing something wrong because even with flags(final); all metrics and errors are still being sent to Splunk. I just need to restrict  ressources because used memory grows uncontrollably until it reaches the 256Mb allocated to the container. Thank's a lot Daniel ... View more