Pipeline changes message everywhere

Graylog Central (peer support)
1

Message Processors Configuration

  1. Message Filter Chain >>> 2. Pipeline Processor
    There is one JSON extractor that flattens and splits into fields.

I have two streams setup that captures the same set of data based on the same rules. Each stream is set to a separate index set leaving the original intact.

I created a pipeline to remove a number of fields from one of the two streams that I created. Everything works up to this point, two streams of data and a working pipeline that removes a few fields. Here is the problem, the fields that are removed are done so across all three streams/index sets. The index sets being the default, and stream one and two index sets.

I can see this if I ran the pipeline against the default all messages stream but I only targeted the one stream with the pipeline.

Is this correct?

2

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.