Message in the Stream but not managed by pipeline

Hi I’m using Graylog 4.0.7.
I’m looking a strange situation.
I send messages using beats and arrive in the correct Stream (I can see them in it).
But they are not processed by the pipeline where I add a simple rule (when true …) that add a field.

In the stream I see the messages but not the field I added using pipeline rule

The pipeline is correctly added to the expected Stream.
Anyone can help me? What I should see?

When I used graylog 2 I never had that proboem. Maybe there is something thet I don’t know?


I solved it
It was caused by Message Processors Configuration with not corrected processor order


Hello @gianluca-valentini, thanks so much for sharing your solution with the community!

Yes, it is not obvious that sorting messages into streams happens in “Message Filter Chain”.
Hm. Maybe it would make sense to have “Stream sorting” as a separate processing step?

PS: Did you know that pipelines have their own way of adding messages to streams?
Check out pipeline functions remove_from_stream(); and route_to_stream();

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.