Help Creating Stream

I’m trying to create a stream for this search query

identity:ams_production level: 3 AND message: 'AmsAusLiveToVodStatusShellJob Live To Vod Converting failed or deleted'

and for my stream rules I have the fallowing options;

* Field  *identity*  must match exactly  *ams_production*
* Field  *level*  must be smaller than  *3*
* Field  *message*  must not match exactly  *'AmsAusLiveToVodStatusShellJob Live To Vod Converting failed or deleted'*

The stream is not display any of the data from the original search query under the stream. What am I missing?

Do it one by one.
Do three stream for every rule, and you Will find the error.

I have tried and for whatever reason none of them are showing the correct rules.

first it isn’t that nice to post the same question over different places …

(and not connect the posts to each other )

Your search in the first screenshot is not what you like to get into your stream. In addition you did not show the expanded message - so no idea if the messages have the fields or not.

Having a full sentence match like you have in your last rule is a bad idea, just for performance reasons. Every messages will run into this regex and will be checked on that.

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.