I setup my universal forwarder to monitor a folder and send the contents to one of my indexers. That works great. I changed the inputs.conf from the monitor stanza to the batch stanza and added the property `move_policy=sinkhole`. I expected that the files in the folder would be deleted after they are sent to the indexer. This is not happening. The documentation indicates that this should be the case. Does the Universal Forwarder support the batch stanza?
↧