Can we write UDP or TCP streams directly to indexer ports rather than using a Universal Forwarder in between?
Yes, look at the tcp and udp stanzas in inputs.conf.
View solution in original post