Cloned message issue

Graylog Central (peer support)
, ,
1

Hi,
I added a cloned_message() function in my first pipeline step and the message does not is visible on graylog stream.
When I remove that cloning, then the message arrives and is visible on Stream1
I need to route the incoming message to Stream1 and Stream2 with their pipeline but befor it I have to duplicate the initial message.

Where am I doing wrong
This is my stage -1 rule code where I try to route the cloned message to Stream2:

rule "Route to Stream2"
when
  true
then
  let cloned = clone_message();
  set_field(field: "compliance", value: "true", prefix: "_", suffix:"_", message: cloned);
  route_to_stream(name: "Stream2", message: cloned);
end

please help me to understand this strange situation

2

Do you get any errors in the Graylog server log? You could use the debug() function to see what you are getting…

When I did some looking for an example structure of clone_message() I came across an interesting link.

Is this something that was working and stopped or are you circling back to it?

3

Hi @tmacgbay
thanks for your answer. With your debug function help I know that the clone operation starts a loop as I see the cloned messages a lot of time.
So the cloned message start the incoming message pipeline too?
What is the best approach to clone a message and route it only to a selected Stream?

4

Considering you were saying there is a loop and others have noticed odd stuff with clone_message()… maybe try and work with create_message()

Not expert enough to help beyond that.

5

Thanks for your suggestion.
Now it works fine even if the souted message is present twice in the original Stream1 even if I routed the cloned message to the Stream2.
I tried to remove cloned message from Stream1 but it is always present :frowning:

6

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.