Help Creating Stream

Graylog Central (peer support)
1

I’m trying to create a stream for this search query

identity:ams_production level: 3 AND message: 'AmsAusLiveToVodStatusShellJob Live To Vod Converting failed or deleted'

and for my stream rules I have the fallowing options;

* Field  *identity*  must match exactly  *ams_production*
* Field  *level*  must be smaller than  *3*
* Field  *message*  must not match exactly  *'AmsAusLiveToVodStatusShellJob Live To Vod Converting failed or deleted'*

The stream is not display any of the data from the original search query under the stream. What am I missing?

2

Do it one by one.
Do three stream for every rule, and you Will find the error.

3

I have tried and for whatever reason none of them are showing the correct rules.

4

first it isn’t that nice to post the same question over different places …

(and not connect the posts to each other )

Your search in the first screenshot is not what you like to get into your stream. In addition you did not show the expanded message - so no idea if the messages have the fields or not.

Having a full sentence match like you have in your last rule is a bad idea, just for performance reasons. Every messages will run into this regex and will be checked on that.