I realize this is a very old post, but as I was browsing I didn't see an answer to your questions. The best answer is probably to use a LightweightForwarders. Yes, I know it's supposedly deprecated, but it does pretty much what you want. That is, it sends cooked, but unparsed/unindexed data to the indexer. It also gives you all of the functionality such as Python, HEC inputs, etc. By default, the LightweightForwarder will disable the web interface, but that can be turned though the web.conf setting. I use this configuration in my DMZ.
... View more