1. Describe your incident:
We are routing specific messages to a different Streams/Indexes with pipeline rules
Now i tried to further specify this routing.
So I created a more specific Rule in the same Pipeline and used “None or more rules on this stage match” and expected stuff that did match this rule to not get forwarded to the later Pipeline stages.
But they still did get routed to both Streams.
I now used a different approach to get the message routing in order.
(Created a new Pipeline connected it to the original destination Stream, then routed the specific messages to the new stream and removed the messages form the original stream)
But it seems “None or more rules on this stage match” Processing does not work correctly.
2. Describe your environment:
-
OS Information:
Ubuntu 20.04 -
Package Version:
Graylog 5.1.2+d970230
3. What steps have you already taken to try and solve the problem?
I tried the following to recreate the most simple Testcase:
- Create a Pipeline rule that always matches (1=1 or something like that)
- Create a Pipeline
- Create a Stage that uses “None or more rules on this stage match” as the continue processing option and add the rule that always matches
- Create a Stage after that one
- Connect a stream (tried it with all Messages and specific streams)
- The later stage is still getting all the messages even though it should get none.
4. How can the community help?
Does anybody use that processing methode and it works on thier end?
Did I just understand how that method is supposed to work?