Configuration of streams

Graylog Central (peer support)
,
8

If you want to find fields directly in message field, you can use this pipeline rule:

rule "msg"
when
    contains(to_string($message.message), "key=") OR 
    contains(to_string($message.message), "cwd=")
then
    route_to_stream(name: "Syslog commands logs");
end