Error This message would not be routed to this stream

Greetings to you all,

I have some problems with my graylog server Graylog v3.2.3+a9c061c. I am sending pfsense snort logs from an rsyslog server and they are showing up in graylog. I have created a pipeline and connected it to a stream. The stream has the following rules;

Stream “Snort Alerts”

Rule 1:

message must match regular expression ^\s?[\d+:\d+:\d+].*

Rule 2:

application_name must match exactly snort-alerts

I have also followed this guide; [Pfsense Snort logs not parsing (Resolved)] for my setup. When i test a received message against my newly created stream, it fails with the following error. This message would not be routed to this stream and looks like it has issues with #Rule 1. As a result the snort logs are not being parsed and i’m stuck. Please help.

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.