I am testing Pipelines and created the below Rule “Detect Undefined” and Pipeline which is connected to “All messages” and when i search for the rule name in All messages i get results
The issue is when i deleted the Rule “Detect Undefined” and the Pipeline i am still getting results when searching for “Detect Undefined” in the last 5min! is that normal ? why should i remain getting these messages after an hour of pipeline and rule deletion? (the rule is satisfied and there is an Undefined string in the message).
But the rule is deleted ! and should not be running anymore…
Here is a screenshot after deleting the pipeline and rule(field pipelineDetection was set in the rule shown below)
Graylog version: Graylog 2.4.7+9116ead
rule "Detect Undefined" when contains(to_string($message.message),"Undefined",false) then set_field("pipelineDetection","Detect Undefined"); end