Issue with clone routing


#1

Hello everyone,
i have problem on my graylog 2.3.0 with pipeline processor.
On my last stage i want put the processed message to another stream and keep the original message on the main stream.

rule "RouteToSecurityStream"
when
  true
then
 let x = clone_message();
 route_to_stream(id: "59a5.....................", message: x);
end

With this rule the message not keeped in the source stream.

Similar to : stream-routing-issue/1541

Kind Regards, TenGbps.


(Jochen) #2

The route_to_stream() function doesn’t remove messages from the default stream, so cloning the message in your rule is unnecessary.

Are there any other stream rules which match for these messages and remove them from the default message stream?

What’s that?


#3

I clone the message because i edit them

set_field("nginxflag", "1");

I dont know, because when i just use route_to_stream() the message be not present on the both stream only on the routed stream.


#4

You right, sorry for that.


(system) #5

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.