Overhead if route_to_stream to another Index Set?

Graylog Central (peer support)
,
1

Hello,

Consider the following use case:

Input 1 -> Stream 1 (Index set 1) <=> Pipeline 1 with multiple stages and rules.

One of these rules calls route_to_stream to route matching messages to Stream 2, and Stream 2 is using another Index Set (so I have to call remove_from_stream to avoid duplicated messages).

My question: Does routing from one stream to another with a different Index Set, and deleting the message adds unnecessary pressure on the storage ? Is the messages physically written to Index Set 1, the Deleted from Index Set 1 then written on Index Set 2 ? Or does GrayLog only write the message in the final Index Set ?

Thanks,
Best regards

2

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.