All,
Still have an issue with extended search Views. Prior to my last attempt to find out why messages were not showing up in my selected stream in the Views section.
What I ended up doing was wiping everything and recreated Stream, and Views from scratch.
I made a stream called “Veeam: License Is Expiring” with a Rule Field EventID must match exactly 24040
Then I created Extended search in Views called “Veeam”.
The first query I’m using “Search in all messages “, streams:5dcde5ac83d72ee2df7789b1
The second query I’m using “Search in all messages “, using the stream drop down “Veeam: License Is Expiring”.
As shown below the first query shows all my messages in that stream.
The second query is skipping messages as you can see by the dates
And this is the stream i’ve created
Before when I used the stream in Views it would only show 1 message, even thou I would search for All Messages. Now it seems like it only shows Odd dates and maybe be skipping some messages.
Any advice, Ideas or direction would be appreciated.
Thank you in advance.
Environment
CentOS Linux release 7.7.1908 (Core)
6 CPU, 8 GB Memory, 500GB Disk.
Graylog 3.1.3+cda805f
MongoDB shell version v4.2.2
Elasticsearch “6.8.5", lucene_version : “7.7.2”