Hi.
I took out this thread for an addition... for a problem i found in my infrastructure...
The Infrastructure
UFs -- [HF] -- IDX
The problem
... do to firewall problems, all UFs have outputs to point to both HF and IDX, at the same time, in default stanza... some hosts join IDX directly (since fw blocks HF flow), some join HF only (same as before), some join both... i found that when some inputs go to IDX direcly i got my props (IDX only) parsed right, when passing through HF (no props), parsing is broken (HF-->IDX, HF parses source by default and passes wrong events to IDX which do not elaborate/parse props as well).
The solution
Deploying same props both to IDX, as well, and also to HF, by giving HF same DS as IDX has. Ok.
The workaround (if possible, i don't think can do it)
Bypass parsing (props) in HF and forwarding datas as a common UF to IDX.
Is there a conf to match this behaviour?
Thanks.
... View more