# Drop message before "All Messages" stream

**URL:** <https://community.graylog.org/t/drop-message-before-all-messages-stream/14609>\
**Category:** Graylog Central (peer support)\
**Tags:** pipeline-rules, route-to-streampl\
**Created:** [March 24, 2020, 7:53am UTC](https://community.graylog.org/t/drop-message-before-all-messages-stream/14609 "2020-03-24T07:53:24Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![darung](https://avatars.discourse-cdn.com/v4/letter/d/a8b319/32.png) [@darung](https://community.graylog.org/u/darung)\
**Post date:** [March 24, 2020, 7:53am UTC](https://community.graylog.org/t/drop-message-before-all-messages-stream/14609/1 "2020-03-24T07:53:24Z")

</div>

Hi

I am trying to drop some messages before they go into the “all messages” stream and therefore get indexed. I have a single input (syslog udp) and some extractors on it.  
I’m new to graylog and could not figure out how to do this - the pipeline and rule I created are working but can only be applied to streams (but not to “all messages”), at which point the message I would like to drop is already routed into “all messages” as well.

Processors order is Message Filter Chain then pipelines.

What am I misunderstanding here?  
Thanks in advance

---

<div class="post-metadata">

**Author:** ![Ponet](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/ponet/32/2131_2.png) [@Ponet](https://community.graylog.org/u/Ponet)\
**Post date:** [March 24, 2020, 10:40am UTC](https://community.graylog.org/t/drop-message-before-all-messages-stream/14609/2 "2020-03-24T10:40:27Z")

</div>

Messages only get indexed after going through the entire message processing chain.

You should be able to create a pipeline with the All Messages stream connected and add your drop rule into that.

---

<div class="post-metadata">

**Author:** ![darung](https://avatars.discourse-cdn.com/v4/letter/d/a8b319/32.png) [@darung](https://community.graylog.org/u/darung)\
**Post date:** [March 24, 2020, 11:58am UTC](https://community.graylog.org/t/drop-message-before-all-messages-stream/14609/3 "2020-03-24T11:58:18Z")

</div>

Thanks it works now!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [April 7, 2020, 11:58am UTC](https://community.graylog.org/t/drop-message-before-all-messages-stream/14609/4 "2020-04-07T11:58:30Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.