# All Messages Stream not showing up

**URL:** <https://community.graylog.org/t/all-messages-stream-not-showing-up/26544>\
**Category:** Graylog Central (peer support)\
**Created:** [November 15, 2022, 1:51pm UTC](https://community.graylog.org/t/all-messages-stream-not-showing-up/26544 "2022-11-15T13:51:45Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Amitdhatwalia](https://avatars.discourse-cdn.com/v4/letter/a/439d5e/32.png) [@Amitdhatwalia](https://community.graylog.org/u/Amitdhatwalia)\
**Post date:** [November 15, 2022, 1:51pm UTC](https://community.graylog.org/t/all-messages-stream-not-showing-up/26544/1 "2022-11-15T13:51:45Z")

</div>

Hello All,

We are trying to integrate our graylog 2.0 server with Splunk. For this purpose we have installed the greylog splunk plugin and created the respective output also.

In my system I am not able to see “All Messages” stream. How to enable/see "All messages: stream in the system.

Thanks in Advance.

---

<div class="post-metadata">

**Author:** ![ihe](https://avatars.discourse-cdn.com/v4/letter/i/a88e57/32.png) [@ihe](https://community.graylog.org/u/ihe)\
**Post date:** [November 15, 2022, 5:45pm UTC](https://community.graylog.org/t/all-messages-stream-not-showing-up/26544/2 "2022-11-15T17:45:28Z")

</div>

hi @Amitdhatwalia  
Graylog 2.0 is very old - to be honest. Do you use it in production?  
Outputs are configured per stream - Which streams do you have listed under /streams in your instance?

---

<div class="post-metadata">

**Author:** ![Amitdhatwalia](https://avatars.discourse-cdn.com/v4/letter/a/439d5e/32.png) [@Amitdhatwalia](https://community.graylog.org/u/Amitdhatwalia)\
**Post date:** [November 16, 2022, 6:09am UTC](https://community.graylog.org/t/all-messages-stream-not-showing-up/26544/3 "2022-11-16T06:09:45Z")

</div>

Hello,

Yes it’s quite old but unfortunately in production. There are multiple streams configured but i dont see any messages routed to these streams. Can you suggest how to create a stream which captures all logs/events being recieved at graylog server as I need all raw data to be forwarded to my SIEM solution.

---

<div class="post-metadata">

**Author:** ![ihe](https://avatars.discourse-cdn.com/v4/letter/i/a88e57/32.png) [@ihe](https://community.graylog.org/u/ihe)\
**Post date:** [November 16, 2022, 10:37am UTC](https://community.graylog.org/t/all-messages-stream-not-showing-up/26544/4 "2022-11-16T10:37:46Z")

</div>

all messages stored somewhere are in at least one stream. Usually I do remove them from all messages, as soon as I make sense out of those logs and put them into their according stream by topic. This might be the same in your instance.  
The way to go here from my point of view would be to configure an output for each stream containig data.

---

<div class="post-metadata">

**Author:** ![aaronsachs](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/aaronsachs/32/7180_2.png) [@aaronsachs](https://community.graylog.org/u/aaronsachs)\
**Post date:** [November 16, 2022, 6:33pm UTC](https://community.graylog.org/t/all-messages-stream-not-showing-up/26544/5 "2022-11-16T18:33:33Z")

</div>

At the risk of stating the obvious–2.0 isn’t event maintained any more. That to me is more of a threat in production than taking it down to upgrade. If it’s critical business infrastructure, then I’m guessing y’all’s security team wants to make sure that it’s patched and supported, which a 6 year old version of Graylog isn’t. Even getting up to 3.0 would put you at a 3 year old version of Graylog 😬😬😬😬. Being on something this old makes supporting your deployment pretty difficult tbh.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [November 30, 2022, 6:33pm UTC](https://community.graylog.org/t/all-messages-stream-not-showing-up/26544/6 "2022-11-30T18:33:55Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.
