That’s unfortunately not that easy with only the stream rule ID.
With a reasonably modern version of MongoDB, you could use the following aggregation to get the corresponding stream to a stream rule ID (you’ll have to fill in the Stream Rule ID in the $match
stage of the aggregation pipeline):
db.streamrules.aggregate([
{ $match : { _id : ObjectId("--> Stream Rule ID <--") } },
{ $lookup: { from: "streams", localField: "stream_id", foreignField: "_id", as: "streams" } },
{ $replaceRoot: { newRoot: { $mergeObjects: [ { $arrayElemAt: [ "$streams", 0 ] }, "$$ROOT" ] } } },
{ $project : { _id: 1 , stream_id: 1, title: 1 } }
]);
Example
$ mongo graylog
MongoDB shell version v3.6.4
connecting to: mongodb://127.0.0.1:27017/graylog
MongoDB server version: 3.6.4
> db.streamrules.aggregate([
... { $match : { _id : ObjectId("5adf23ef4b900a0fdb4e51f7") } },
... { $lookup: { from: "streams", localField: "stream_id", foreignField: "_id", as: "streams" } },
... { $replaceRoot: { newRoot: { $mergeObjects: [ { $arrayElemAt: [ "$streams", 0 ] }, "$$ROOT" ] } } },
... { $project : { _id: 1 , stream_id: 1, title: 1 } }
... ]);
{ "_id" : ObjectId("5adf23ef4b900a0fdb4e51f7"), "title" : "Test Stream", "stream_id" : ObjectId("5adf23894b900a0fdb4e517d") }
This being said, the stream rule metrics should really include the name of the stream they belong to.
For reference: