Drop message before "All Messages" stream

Graylog Central (peer support)
,
1

Hi

I am trying to drop some messages before they go into the “all messages” stream and therefore get indexed. I have a single input (syslog udp) and some extractors on it.
I’m new to graylog and could not figure out how to do this - the pipeline and rule I created are working but can only be applied to streams (but not to “all messages”), at which point the message I would like to drop is already routed into “all messages” as well.

Processors order is Message Filter Chain then pipelines.

What am I misunderstanding here?
Thanks in advance

2

Messages only get indexed after going through the entire message processing chain.

You should be able to create a pipeline with the All Messages stream connected and add your drop rule into that.

3

Thanks it works now!

1 Like
4

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.