1. Describe your incident:
Input being received, messages are being seen in input.
I created an index for it as well as a stream, then created a pipeline rule to filter the incoming input id and send it to the stream id. I have done this with two other inputs and both are working but this one doesn’t show the messages in the stream.
2. Describe your environment:
-
OS Information:
-
Ubuntu 22.04
-
Timezones set to UTC
-
Package Version:
Graylog open 6.1.12 -
Service logs, configurations, and environment variables:
Pipeline rule
rule "Move WLC Logs To WLC Stream"
when
from_input(id: "6849696912a8694b9f320e8a")
then
route_to_stream(id: "6849782812a8694b9f32bb34", remove_from_default: true);
end
3. What steps have you already taken to try and solve the problem?
Already built 2 other inputs, indexes, streams and pipeline using the same rule ( changing the id’s) and they both work, I have completely deleted this rule, pipeline, index and stream and recreated and still the same issue.
4. How can the community help?
Any ideas what I am missing and why the messages are not coming through to the stream, I can see the messages being processed by the pipeline and when I look at a message directly from the input it states that it is being routed to the correct stream. I can also see the throughput on the stream screen showing message coming into the stream.
Just created a completely new input from a different device, new index, stream and pipeline and these messages are not coming through either. The in/out buffer is maxing about 20. No idea what I am doing wrong when the first 2 worked without issue
Helpful Posting Tips: Tips for Posting Questions that Get Answers [Hold down CTRL and link on link to open tips documents in a separate tab]