Issue with pipeline and stream not seeing messages the are being received

1. Describe your incident:
Input being received, messages are being seen in input.
I created an index for it as well as a stream, then created a pipeline rule to filter the incoming input id and send it to the stream id. I have done this with two other inputs and both are working but this one doesn’t show the messages in the stream.

2. Describe your environment:

  • OS Information:

  • Ubuntu 22.04

  • Timezones set to UTC

  • Package Version:
    Graylog open 6.1.12

  • Service logs, configurations, and environment variables:
    Pipeline rule

rule "Move WLC Logs To WLC Stream"
when
  from_input(id: "6849696912a8694b9f320e8a")
then
  route_to_stream(id: "6849782812a8694b9f32bb34", remove_from_default: true);
end

3. What steps have you already taken to try and solve the problem?
Already built 2 other inputs, indexes, streams and pipeline using the same rule ( changing the id’s) and they both work, I have completely deleted this rule, pipeline, index and stream and recreated and still the same issue.

4. How can the community help?
Any ideas what I am missing and why the messages are not coming through to the stream, I can see the messages being processed by the pipeline and when I look at a message directly from the input it states that it is being routed to the correct stream. I can also see the throughput on the stream screen showing message coming into the stream.

Just created a completely new input from a different device, new index, stream and pipeline and these messages are not coming through either. The in/out buffer is maxing about 20. No idea what I am doing wrong when the first 2 worked without issue

Helpful Posting Tips: Tips for Posting Questions that Get Answers [Hold down CTRL and link on link to open tips documents in a separate tab]

Time zone issue? If messages are being routed successfully, then the problem must be related to how you are searching for the messages.

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.