splunk universal forwerder to splunk enterprise with configured HEC (all on centos 7)

Hello , i have spent couple of days to reach some proper loggin to HEC on my enterprise splunk but cant handle it. I have configured also splunk app for infrastructure and i have added the host to be monitored . The logs are send to one of the HEC which is configured for em_metrics but i want to add additinal configuration on the universal forwarder to monitor some logs. I can collect logs but over the splunk`s input on 9997/tcp . I want to reach it over the additianal HEC which i already have created on the enterprise instance. Can you give me some example how to configure proper inputs.conf and outputs.conf to be send to my HEC.