Need help undertsanding the flow

[kitkat0981]

so please correct me if i’m wrong as i dont seem to be either grasping the flow of configuring my graylog properly.
Running 6.0.14
opensearch

inputs via specific port (example, i have all syslogs from any linux machines comming in)
stream is to categorize the entries?

the reason i ask is I have my input setup

then my index (this example is PowerDNS)

then my stream with a rule:

I know and have confirmed there are logs comming in for this device, yet when i go to search page and select the stream and click the search button, i dont see any logs:

what am i missing or not understanding?

[kitkat0981]

can anyone provide some guidance? what im looking for is if I have an input (example avaya switches) that all log to 1 specific input since you cannot change the port (all go to 514) so I want to containerize the logs for each individual switches. How can I do this? Thanks

[patrickmann]

Your search is limited to PowerDNS stream. Try just using the default stream first to keep things simple. Once that works you can route to different streams.

[kitkat0981]

and just to be clear, i see the data in the input. how do you send those to indexes? is it using the gl2_input_source and the # ?

[patrickmann]

Streams are used to route messages to indices.
The default stream automatically goes to the default index. If you create additional indices, you need to also define corresponding streams.

[kitkat0981]

Ok so if you have multiple servers logging to one input, how do you then seperate each server to it’s one index?

[patrickmann]

Use a pipeline rule on the default stream to route each to its own stream, which is associated with its own index.

[kitkat0981]

Ah ! Now I think I understand. I’ll try that thanks a lot !

[kitkat0981]

hmmm. maybe i don’t understand…

My input works thats a fact as i can see the messages.
i dont have any indeces so its using the default index set.
i have a pipeline setup named “redirecting NPS” connected to the default stream.

but then what? I need to apply rules but this is all coding..?!?

[kitkat0981]

i see a lot of useless (to me) logs coming from the domain controller (windows). how can I NOT include theses in the streams?

[patrickmann]

Please review the related docs. These are very basic scenarios and all covered in the docs.

Streams

Build Pipeline Rules