My rules for streams are not working

Graylog Central (peer support)
1

Before you post: Your responses to these questions will help the community help you. Please complete this template if you’re asking a support question.
Don’t forget to select tags to help index your topic!

1. Describe your incident:
I have messages from cisco-switches that I would like to separate with different streams. The distinction should be the hostname.

2. Describe your environment:

  • OS Information: Ubuntu

  • Package Version: 6.0.5

  • Service logs, configurations, and environment variables:

3. What steps have you already taken to try and solve the problem?

The hostname is for example: lv-mg-ev111.xxxx.com

My rules:
image

But the stream remains empty, it does not work.
What could be my problem?

2

Hey @reni,

Could you try with ‘lv-mg-ev*’, the wildcard should help catch what you are after.

3

Thanks, but doesn’t work either. The messages remain in the default stream.
I also tried the following: “hostname must match regular expression lv-mg-ev*” :frowning:
Strangely enough, a test when creating the rule works with a message.
If I then create the same message again, nothing goes into the stream.

4

I have now helped myself with “gl2_remote_ip must contain ”.
Unfortunately, this results in more rules, but that’s how it works.
In version 4.3.15 it still worked very well with the “hostname”.

5

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.