I would like to use Streams in a way that is maybe not following some general idea of Graylog - so this may a bit of architecture question of logs messages flow.
I’m using Graylog on prem with graylog-server 6.1.8-1
.
I’m familiar with idea of Default Stream, but I would like to achieve following architecture:
- create 2 Inputs
input_servers
andinput_netdevices
- create Stream
stream_servers_all
and set rule on it, sayinggl2_source_input matches id of input_servers
and point it to some indexindex_servers
, rule set to remove message fromDefault Stream
- create Stream
stream_netdevices_all
and set rule on it, sayinggl2_source_input matches id of input_netdevices
and point it to some indexindex_netdevices
, rule set to remove message fromDefault Stream
After steps 1-3 there would be 2 Streams, each writing to it’s own Index, and this is business separation of 2 different origins of log messages.
Above is working, but then I would like to do so:
-
create Stream
stream_servers_of_big_interest_or_whatever
and point it to some different index -
create pipeline in Stream
stream_servers_all
with followingPipeline Rule
:
rule "route-logs-from-special-care-servers-to-their-own-stream"
when
grok(value: to_string($message."designated_field"), pattern: "%{OUR_CRAFTED_REGEX}").matches == true
then
route_to_stream( name : "stream_servers_of_big_interest_or_whatever");
remove_from_stream(name : "stream_servers_all");
end
Above Pipeline Rule called in Pipeline for Stream stream_servers_all
would take messages of special interest and route_to_stream
them into some other stream.
But as I no longer need this message to be in Stream on which Pipeline Rule was called, I would like to remove_from_stream
- and here goes a problem:
Inside Pipeline Rule that can be attached to many Pipelines like that - e.g I may have Stream servers_from_team_1
and servers_from_team_2
- I need to literally put a string with a name of Stream, I wish this message to be removed from.
Is there any pre-defined variable that is visible inside Pipeline Rule, saying on which Stream’s pipeline this Pipeline Rule was called?
Or do I really need to end up in calling code like that:
remove_from_stream(name : "i_know_i_run_this_pipeline_rule_on_pipeline_on_this_stream");
remove_from_stream(name : "but_i_also_run_this_pipeline_rule_on_pipeline_on_that_stream");
remove_from_stream(name : "oooooooooohhhhh_and_on_this_stream_i_call_it_too");
Or is it so, that having a messages only on one Stream, and effectively moving it from one Stream to another Stream like above is a kind of big misuse?