I’m trying to create a stream for this search query
identity:ams_production level: 3 AND message: 'AmsAusLiveToVodStatusShellJob Live To Vod Converting failed or deleted'
and for my stream rules I have the fallowing options;
* Field *identity* must match exactly *ams_production*
* Field *level* must be smaller than *3*
* Field *message* must not match exactly *'AmsAusLiveToVodStatusShellJob Live To Vod Converting failed or deleted'*
The stream is not display any of the data from the original search query under the stream. What am I missing?
first it isn’t that nice to post the same question over different places …
(and not connect the posts to each other )
Your search in the first screenshot is not what you like to get into your stream. In addition you did not show the expanded message - so no idea if the messages have the fields or not.
Having a full sentence match like you have in your last rule is a bad idea, just for performance reasons. Every messages will run into this regex and will be checked on that.