I need to put all data ingested by a specific TCP Input entry into a specific index user made. For this in the UI of Graylog I created a Stream on this index. Checked “Remove matches from ‘All messages’ stream”.
When create/edit the TCP Input I cannot find any place for Stream binding.
I created a single stream rule “Rule always matches” for the stream created above.
Question:
How do I connect my specific TCP Input to this Stream (and thus index)?
I want other TCP Inputs to keep storing record’s on Graylog’s default index - but this one. I noticed that other TCP Inputs started ingest the record in my user-made index too.
I would like not to touch the Graylog’s All Messages Stream.
what if Instead:
I create my own stream connected to my index, and without any rule
Have the “Remove matches from ‘All messages’ stream” checked for this stream.
Create a new Pipeline.
Connect this pipeline to my stream.
Create a Pipeline rule.
rule "Input for Oracle Audit"
when
from_input("My TCP Input")
then
end
Add this pipeline rule to Stage 0 of my pipeline
I tried the above, but the message went to Stream “All Messages”, and not to my Stream.
I did. But what am I supposed to find there?
The Simulation results are identical with Original message.
May be I am not getting something, sorry, but my Graylog knowledge is limited
What really does help is showing us what you see. In the form of logs , errors/warning and even Information. The completed configuration of what you are executing. I can only guess from over here on what’s happening in your environment without see what you see.
Rule "Route to stream"
when
has_field("DB_NAME") AND contains(to_string($message.DB_NAME), "dblive01")
then
route_to_stream(name: "Oracle Audit Stream", remove_from_default: true);
end
NOTE: If the stream name “Oracle Audit Stream” does not work you may need to us the Stream ID instead.
route_to_stream(id:"the_ID _of_the_stream");
To get the ID click on the stream you want and the ID would be located in your URL as shown below
NEXT
make sure your configuration is set with the pipeline processor after message filter chain…
Something like this.
To find your Message Processors Configuration Navigate to System/Configurations.
I haven’t used from_input in my rules yet but I wanted to see if you pipeline is able to route to a stream first, I think this is the easiest way testing your pipeline out . Then we can go from there.
EDIT: You may need to wait a few minutes to see results, this depends on your environment.
