Hi I am trying to drop some messages before they go into the “all messages” stream and therefore get indexed. I have a single input (syslog udp) and some extractors on it. I’m new to graylog and could not figure out how to do this - the pipeline and rule I created are working but can only be appli…

Drop message before "All Messages" stream

Ponet (Jesse Hills) March 24, 2020, 10:40am 2

Messages only get indexed after going through the entire message processing chain.

You should be able to create a pipeline with the All Messages stream connected and add your drop rule into that.

Pipeline Drop Message Not Working

Topic		Replies	Views
Filter logs Received Graylog Central (peer support) documentation	4	93	August 8, 2024
Dropping messages using Pipelines Graylog Central (peer support) pipeline-rules , debuggingpl	4	7196	August 2, 2019
Another pipleline question Graylog Central (peer support) pipeline-rules	6	434	March 1, 2022
Routing Messages Across Streams and Index Sets Graylog Central (peer support) pipeline-rules , route-to-streampl	2	1765	February 8, 2018
Drop Incoming Message Containing a Specific Word Graylog Central (peer support)	7	4383	August 27, 2019