Hello everyone, I would like to configure a stream so that it necessarily matches with a rule (the source of this stream), and that it necessarily matches with one of the other two rules that I have set up (because I would like that only two types of messages appear). But I don’t know how to do it …

If you want to find fields directly in message field, you can use this pipeline rule: rule "msg" when contains(to_string($message.message), "key=") OR contains(to_string($message.message), "cwd=") then route_to_stream(name: "Syslog commands logs"); end

Configuration of streams

Graylog Central (peer support)

Cruciani_Elliot July 1, 2020, 12:06pm 7

@shoothub Not really, it’s something that is present in the two field messages of the logs I want to filter. My goal here is to say "all logs that come from Serveur03 and that have “key=” or “cwd=” in the field messages go into the stream “Syslog commands logs”.

Topic		Replies	Views
Test Against Stream ALL GREEN but message not routed in stream Graylog Central (peer support) pipeline-rules , route-to-streampl	3	664	June 2, 2018
Multi Part Rule within Streams Graylog Central (peer support) pipeline-rules , route-to-streampl , sidecar , winlogbeat	5	1637	July 31, 2020
Pipeline doest not route to stream Graylog Central (peer support) pipeline-rules , route-to-streampl , debuggingpl	10	2472	August 14, 2020
Pipeline Rules Works if Streams is set to "All Messages" but not specific Stream Graylog Central (peer support) pipeline-rules	3	591	June 7, 2021
Pipeline rules only being applied to default "All Messages" Stream Graylog Central (peer support) pipeline-rules , route-to-streampl	1	864	February 16, 2017

Configuration of streams

Related topics