How to How you create custom field

Graylog Central (peer support)
1

Hello

I begin on graylog and I would like to create a Stream to filter projects with container_name

I alrealdy create Stream rule but the result is not complete or not :frowning:
I try to create custom field suggest by Jochen is this topic : How to create Stream Rule for containers
but I canā€™t do it.
If you have a time to explain me and try a true caseā€¦
thx in advance.
Jeremie

2

What did you do exactly?
What did you expect to happen?
What was the actual result?

3

Hi Jochen
I want to have a Stream by project and in this stream I want only logs about containers concerned.
Today I just create the stream rules like in previous topic.
I donā€™t understand the custom fields :frowning:

4

What did you do so far?

5

I only do stream rules

6

Please elaborate on the details.

7

When I try to search in all messages stream with container_name:XXXX itā€™s ok but if I create a new stream with rule container_name contain XXXX itā€™s not ok (no logs)

8

Only new messages will be visible in the newly created stream. Existing messages wonā€™t be part of the stream.

9

Yes I know but I tried to generate some logs after create new one but nothing :frowning:

10

Maybe your stream rule didnā€™t match. Maybe the field you were referring to didnā€™t exist.

Hard to say with so little detailsā€¦

11

An exemple with a project : proxy-parrainage
in all messages stream, if I try this search : container_name:proxy-parrainage*

image
image.png1113Ɨ704 58.9 KB

I have a results but if Iā€™m going into my parrainage stream with this rules
image
no message :frowning:
I donā€™t understand why

12

maybe it did not work, because the field does not contain parrainage_* but would contain parrainage and you defined that both must match - rethink what you have configured.

13

I have 2 rules because I have 2 containers in my project : parrainage and proxy-parraiange

14

What @jan said in How to How you create custom field plus the stream rules donā€™t support wildcards (* and ?).

15

Ok I donā€™t know stream rules donā€™t support wildcard.
I fixed for proxy-parrainage and itā€™s working.
but for my rule ā€œparrainageā€ I donā€™t have result

16

I found my error, by default streaml rules must match all of rules :slight_smile:)
I changed it :slight_smile:image

17

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.