So trying to route my local syslog messages routed to a different input so that I can set a different retension schedule and the pipeline that I have setup is acting unexpectedly:
I have indexes “Main” and “Local” and streams “All messages” (index set Main) and “Local Messages” (index set Local)
My Local input “appliance-syslog-udp” is receiving messages from my local server. When I attempt to use a pipeline rule to route these messages to the “Local Messages” stream and then remove them from the “All messages” stream it is putting messages that came from my global input “WinLogs-gelf” into the “Local Messages” stream.
My rule I have defined are as follows if anyone can see where I went wrong or suggest an alternative I would be very appreciative:
rule "function move main to local" when from_input(id:"\<InputID\>") then // the following date format assumes there's no time zone in the string route_to_stream(id:"\<LocalStreamID\>"); remove_from_stream(id:"\<MainStreamID\>"); end