I just started playing with Graylog very recently and so far it’s been a great experience. However, there are a couple of things I’m trying to do and I’m not sure of the best way (or even how) to achieve them:
Say I want to create a stream (let’s call it “A”) attached to a custom index and with that stream filtering out messages for one of our customer accounts, removing the original from “All messages”. I then want to create a bunch of other streams (“B”, “C” and “D”) that filter out the messages from stream A in different ways, both for searches and for alerting.
It seems like I can only create streams using “All messages” as the source though, so if I want streams B, C and D, I can’t do it using the streams page. It appears that I would have to set up pipelines to manually put the messages into B, C and D. Is this correct? Or am I misunderstanding how streams work?
Say I just wanted to get the number of messages in a stream for a time period, is there any way to do this? I can see a count of the number of messages at a point in time for a seemingly random time period in the ms range but this is arbitrary and not configurable by the user AFAICT.
If anyone has any input regarding the above queries I would be most appreciate of your input.