How to How you create custom field


(RABOEUF) #1

Hello

I begin on graylog and I would like to create a Stream to filter projects with container_name

I alrealdy create Stream rule but the result is not complete or not :frowning:
I try to create custom field suggest by Jochen is this topic : How to create Stream Rule for containers
but I can’t do it.
If you have a time to explain me and try a true case…
thx in advance.
Jeremie


(Jochen) #2

What did you do exactly?
What did you expect to happen?
What was the actual result?


(RABOEUF) #3

Hi Jochen
I want to have a Stream by project and in this stream I want only logs about containers concerned.
Today I just create the stream rules like in previous topic.
I don’t understand the custom fields :frowning:


(Jochen) #4

What did you do so far?


(RABOEUF) #5

I only do stream rules


(Jochen) #6

Please elaborate on the details.


(RABOEUF) #7

When I try to search in all messages stream with container_name:XXXX it’s ok but if I create a new stream with rule container_name contain XXXX it’s not ok (no logs)


(Jochen) #8

Only new messages will be visible in the newly created stream. Existing messages won’t be part of the stream.


(RABOEUF) #9

Yes I know but I tried to generate some logs after create new one but nothing :frowning:


(Jochen) #10

Maybe your stream rule didn’t match. Maybe the field you were referring to didn’t exist.

Hard to say with so little details…


(RABOEUF) #11

An exemple with a project : proxy-parrainage
in all messages stream, if I try this search : container_name:proxy-parrainage*


I have a results but if I’m going into my parrainage stream with this rules
image
no message :frowning:
I don’t understand why


(Jan Doberstein) #12

maybe it did not work, because the field does not contain parrainage_* but would contain parrainage and you defined that both must match - rethink what you have configured.


(RABOEUF) #13

I have 2 rules because I have 2 containers in my project : parrainage and proxy-parraiange


(Jochen) #14

What @jan said in How to How you create custom field plus the stream rules don’t support wildcards (* and ?).


(RABOEUF) #15

Ok I don’t know stream rules don’t support wildcard.
I fixed for proxy-parrainage and it’s working.
but for my rule “parrainage” I don’t have result


(RABOEUF) #16

I found my error, by default streaml rules must match all of rules :slight_smile:)
I changed it :slight_smile:image


(system) #17

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.