Hello, I have a message log that is routed to multiple streams without deleting it from “All messages” in order to perform alerts and some other analytics filtering… The issue is that when we search for the log w get it duplicated, for ex the log below is showing 3 times because its available in 3…

I started from the other side, and I think you will get your answer. So If you store one message in multiple streams, with different index sets, the GL will store the message in multiple times. So if you search, you got all messages. Use one index set for your 3 different streams. OR Start the se…

Thank you @macko003 for your reply you are right, both critical streams shown in the snapshot, are on a index with prefix “critical_alarms” and “All messages” stream is on another index with prefix “graylog” what we can do here is excluding the index starting with “critical_alarms” while searchi…

Honestly, I don’t have a solution for that. Don’t put one massage to different index sets. Config to use all streams the same index set.

[image] macko003: Don’t put one massage to different @macko003 can you elaborate more please ? is it to spare disk space? avoid duplication? or other considerations… please advise,

[image] macko003: So If you store one message in multiple streams, with different index sets, the GL will store the message in multiple times. I can just repeat myself. Check your streams, what index sets its using.

@macko003 we have 2 messages Stored in index: critial_alarms_2 and 1 message stored in index “graylog_537” when i add AND !_index:critial_alarms_2 to the query i get the correct list. but here we want to exclude any critical_alarms index… AND !_index:critial_alarms_* is not working ...

He @chawkimatta you would select only the specific streams you want to search in and do not use the only for admins possible search across all streams. This will allow to get only the results that are inside this stream and the index set that is the base for this stream.

[image] jan: you would select only the specific streams you want to search in and do not use the only for admins possible search across all streams. This will allow to get only the results that are inside this stream and the index set that is the base for this stream. Hi @jan Acctually we ne…

Not sure which you created first, but this seems to be a duplicate thread [image] Exclude a specific Index from search Graylog Central (peer support) Hello, I have message logs stored on 2 indexes with prefix graylog & critial_alarms NB: critial_alarms is for critical…

Exclude all streams other than All messages by query

Graylog Central (peer support)

cawfehman (Cawfehman) May 19, 2020, 6:51pm 10

Not sure which you created first, but this seems to be a duplicate thread

try not to duplicate

Topic		Replies	Views
Exclude a specific Index from search Graylog Central (peer support)	3	1909	May 19, 2020
Search Within Stream Shows Other Streams Graylog Central (peer support)	4	2051	November 26, 2018
Avoid duplication of messages in search Graylog Central (peer support) pipeline-rules	1	438	December 1, 2023
Duplicate message in results of query on specific stream Graylog Central (peer support)	9	2109	January 14, 2022
Stream displays messages from another index Graylog Central (peer support)	4	168	October 28, 2024

Exclude all streams other than All messages by query

Related topics