Quantcast
Channel: Questions in topic: "universal-forwarder"
Viewing all articles
Browse latest Browse all 1551

universal forwarder trying to parse the data

$
0
0
I have a UF monitoring a couple of files on a AIX box. The UF is forwarding the data to a HF, I verified this in outputs.conf. There are no props.conf present for that input on the UF, only at the HF, and they are obviously not being honored. For some strange reason, I see "Breaking event" and "DateParserVerbose" errors on the UF. How come the parsing phase takes place on the UF and not only the forwarding of the data ? I didn't get this behavior on any of my other UFs. This is not an indexed_extraction.

Viewing all articles
Browse latest Browse all 1551

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>