How to How you create custom field

Graylog Central (peer support)
1

Hello

I begin on graylog and I would like to create a Stream to filter projects with container_name

I alrealdy create Stream rule but the result is not complete or not :frowning:
I try to create custom field suggest by Jochen is this topic : How to create Stream Rule for containers
but I can’t do it.
If you have a time to explain me and try a true case…
thx in advance.
Jeremie

2

What did you do exactly?
What did you expect to happen?
What was the actual result?

3

Hi Jochen
I want to have a Stream by project and in this stream I want only logs about containers concerned.
Today I just create the stream rules like in previous topic.
I don’t understand the custom fields :frowning:

4

What did you do so far?

5

I only do stream rules

6

Please elaborate on the details.

7

When I try to search in all messages stream with container_name:XXXX it’s ok but if I create a new stream with rule container_name contain XXXX it’s not ok (no logs)

8

Only new messages will be visible in the newly created stream. Existing messages won’t be part of the stream.

9

Yes I know but I tried to generate some logs after create new one but nothing :frowning:

10

Maybe your stream rule didn’t match. Maybe the field you were referring to didn’t exist.

Hard to say with so little details…

11

An exemple with a project : proxy-parrainage
in all messages stream, if I try this search : container_name:proxy-parrainage*

image
image.png1113×704 58.9 KB

I have a results but if I’m going into my parrainage stream with this rules
image
no message :frowning:
I don’t understand why

12

maybe it did not work, because the field does not contain parrainage_* but would contain parrainage and you defined that both must match - rethink what you have configured.

13

I have 2 rules because I have 2 containers in my project : parrainage and proxy-parraiange

14

What @jan said in How to How you create custom field plus the stream rules don’t support wildcards (* and ?).

15

Ok I don’t know stream rules don’t support wildcard.
I fixed for proxy-parrainage and it’s working.
but for my rule “parrainage” I don’t have result

16

I found my error, by default streaml rules must match all of rules :slight_smile:)
I changed it :slight_smile:image

17

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.