Need help undertsanding the flow

so please correct me if i’m wrong as i dont seem to be either grasping the flow of configuring my graylog properly.
Running 6.0.14
opensearch

inputs via specific port (example, i have all syslogs from any linux machines comming in)
stream is to categorize the entries?

the reason i ask is I have my input setup

then my index (this example is PowerDNS)

then my stream with a rule:

I know and have confirmed there are logs comming in for this device, yet when i go to search page and select the stream and click the search button, i dont see any logs:

what am i missing or not understanding?

can anyone provide some guidance? what im looking for is if I have an input (example avaya switches) that all log to 1 specific input since you cannot change the port (all go to 514) so I want to containerize the logs for each individual switches. How can I do this? Thanks

Your search is limited to PowerDNS stream. Try just using the default stream first to keep things simple. Once that works you can route to different streams.

and just to be clear, i see the data in the input. how do you send those to indexes? is it using the gl2_input_source and the # ?

Streams are used to route messages to indices.
The default stream automatically goes to the default index. If you create additional indices, you need to also define corresponding streams.

Ok so if you have multiple servers logging to one input, how do you then seperate each server to it’s one index?

Use a pipeline rule on the default stream to route each to its own stream, which is associated with its own index.

Ah ! Now I think I understand. I’ll try that thanks a lot !

hmmm. maybe i don’t understand…

My input works thats a fact as i can see the messages.
i dont have any indeces so its using the default index set.
i have a pipeline setup named “redirecting NPS” connected to the default stream.

but then what? I need to apply rules but this is all coding..?!?

i see a lot of useless (to me) logs coming from the domain controller (windows). how can I NOT include theses in the streams?

Please review the related docs. These are very basic scenarios and all covered in the docs.