Messages not get routed into streams, even have 2 streams with exact same rules - one of them works

I am currently trying to setup streams to have my messages sorted into categories.

If i create a stream which just uses a rule on the “message” field using “contains” it does work correctly from the moment i started it.

If i use another field (“application”) (that field was specified in a collector configuration as an additional field) the stream won’t ever get a single message routed into it. Using the search with the same arguments i see hundreds of messages coming in per minute. I tried the “match message against stream” function and that shows green for all the messages as well. Even the “xx messages/seconds” on the stream overview page is going up the same amount than the stream just matching the “message” field. There are no errors in the server log…

Then i did another thing: Created a stream which matches on “message” contains, that worked perfectly. I then added another rule matching on my “application” field and then removed the first rule matching on “message”. Than that stream worked perfectly. Resulting in two streams with the exact same configuration, the one which was modified is getting messages, the other one not. Both are green on the “match message against stream”.

I really don’t understand this and it makes no sense. It seems like some streams only start working after some time is over, some never get working at all.

Is there any additional information i could supply to you on helping me with that question?

now some time is over and all streams are working correctly…

if you have a backlog of messages on the Graylog node such can happen - that you think changes are not applied, but they are - but only visible when the backlog is processed until the time where you changed.

Yes i thought about that too but i checked the node stats and there was no visible backlog in any of the buffers or in the disk yournal. And it’s not minutes - it’s more hours for the streams to get start working…

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.