Cloned message issue

I added a cloned_message() function in my first pipeline step and the message does not is visible on graylog stream.
When I remove that cloning, then the message arrives and is visible on Stream1
I need to route the incoming message to Stream1 and Stream2 with their pipeline but befor it I have to duplicate the initial message.

Where am I doing wrong
This is my stage -1 rule code where I try to route the cloned message to Stream2:

rule "Route to Stream2"
  let cloned = clone_message();
  set_field(field: "compliance", value: "true", prefix: "_", suffix:"_", message: cloned);
  route_to_stream(name: "Stream2", message: cloned);

please help me to understand this strange situation

Do you get any errors in the Graylog server log? You could use the debug() function to see what you are getting…

When I did some looking for an example structure of clone_message() I came across an interesting link.

Is this something that was working and stopped or are you circling back to it?

Hi @tmacgbay
thanks for your answer. With your debug function help I know that the clone operation starts a loop as I see the cloned messages a lot of time.
So the cloned message start the incoming message pipeline too?
What is the best approach to clone a message and route it only to a selected Stream?

Considering you were saying there is a loop and others have noticed odd stuff with clone_message()… maybe try and work with create_message()

Not expert enough to help beyond that.

Thanks for your suggestion.
Now it works fine even if the souted message is present twice in the original Stream1 even if I routed the cloned message to the Stream2.
I tried to remove cloned message from Stream1 but it is always present :frowning:

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.