Message in the Stream but not managed by pipeline

Graylog Central (peer support)
1

Hi I’m using Graylog 4.0.7.
I’m looking a strange situation.
I send messages using beats and arrive in the correct Stream (I can see them in it).
But they are not processed by the pipeline where I add a simple rule (when true …) that add a field.

In the stream I see the messages but not the field I added using pipeline rule

The pipeline is correctly added to the expected Stream.
Anyone can help me? What I should see?

When I used graylog 2 I never had that proboem. Maybe there is something thet I don’t know?

Thanks
Gianluca

2

I solved it
It was caused by Message Processors Configuration with not corrected processor order

3

Hello @gianluca-valentini, thanks so much for sharing your solution with the community!

4

Yes, it is not obvious that sorting messages into streams happens in “Message Filter Chain”.
Hm. Maybe it would make sense to have “Stream sorting” as a separate processing step?

PS: Did you know that pipelines have their own way of adding messages to streams?
Check out pipeline functions remove_from_stream(); and route_to_stream();