Identify Stream Rule from Metrics

Graylog Central (peer support)
1

Hi,

I am trying to make my streams more efficient, so I have browsed to the stream metrics and have identified a few streams that I will need to look into.

However from the stream rule ID given on the metrics page, I cannot find out which stream matches which ID.

image

How would I find the stream listed in the above metric?

Cheers,

G

2

That’s unfortunately not that easy with only the stream rule ID.

With a reasonably modern version of MongoDB, you could use the following aggregation to get the corresponding stream to a stream rule ID (you’ll have to fill in the Stream Rule ID in the $match stage of the aggregation pipeline):

db.streamrules.aggregate([
  { $match : { _id : ObjectId("--> Stream Rule ID <--") } },
  { $lookup: { from: "streams", localField: "stream_id", foreignField: "_id", as: "streams" } },
  { $replaceRoot: { newRoot: { $mergeObjects: [ { $arrayElemAt: [ "$streams", 0 ] }, "$$ROOT" ] } } },
  { $project : { _id: 1 , stream_id: 1, title: 1 } }
]);

Example

$ mongo graylog
MongoDB shell version v3.6.4
connecting to: mongodb://127.0.0.1:27017/graylog
MongoDB server version: 3.6.4
> db.streamrules.aggregate([
... { $match : { _id : ObjectId("5adf23ef4b900a0fdb4e51f7") } },
... { $lookup: { from: "streams", localField: "stream_id", foreignField: "_id", as: "streams" } },
... { $replaceRoot: { newRoot: { $mergeObjects: [ { $arrayElemAt: [ "$streams", 0 ] }, "$$ROOT" ] } } },
... { $project : { _id: 1 , stream_id: 1, title: 1 } }
... ]);
{ "_id" : ObjectId("5adf23ef4b900a0fdb4e51f7"), "title" : "Test Stream", "stream_id" : ObjectId("5adf23894b900a0fdb4e517d") }

This being said, the stream rule metrics should really include the name of the stream they belong to.

For reference:

3

Hi Jochen,

Thank you for the reply.

I have found a way to find out which metric represents the stream rule within the Graylog interface.
All of the rules and metrics are in the same order, so the 5th rule down is the 5th rule metric.

This isn’t the quickest process ever, but it works.

Cheers,

George

4

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.