A few new user questions

Graylog Central (peer support)
1

I just started playing with Graylog very recently and so far it’s been a great experience. However, there are a couple of things I’m trying to do and I’m not sure of the best way (or even how) to achieve them:

  1. Say I want to create a stream (let’s call it “A”) attached to a custom index and with that stream filtering out messages for one of our customer accounts, removing the original from “All messages”. I then want to create a bunch of other streams (“B”, “C” and “D”) that filter out the messages from stream A in different ways, both for searches and for alerting.
    It seems like I can only create streams using “All messages” as the source though, so if I want streams B, C and D, I can’t do it using the streams page. It appears that I would have to set up pipelines to manually put the messages into B, C and D. Is this correct? Or am I misunderstanding how streams work?

  2. Say I just wanted to get the number of messages in a stream for a time period, is there any way to do this? I can see a count of the number of messages at a point in time for a seemingly random time period in the ms range but this is arbitrary and not configurable by the user AFAICT.

If anyone has any input regarding the above queries I would be most appreciate of your input.

Thanks,
Guy

2

@knightsg

  1. It would be the easiest if you route all messages into “A” and then use the pipelines on the Stream “A” to route them into other streams.

  2. If you select the Stream and change the time to “absolute” and search for everything (empty search) you will get the count of messages in this time on that stream.
    This can also added to a dashboard as number.

3

Thanks for your reply Jan. I’ll try doing my first task the way you suggested, with pipelines.

As for the second, I did as suggested, set the time to absolute and entered a time range from x to y (5mins). The result it shows is as follows:

Found 7,840 messages in 5 ms, searched in 1 index.

To me that reads as 7,840 messages in 5 milliseconds which sounds unlikely. Does that ms actually mean minutes and not milliseconds?

Thanks again,
Guy

4

Actually, never mind. I realise now that the 5 ms is actually the search time, not the search period.

5

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.