Hi @smolit,
i’ll have a guess. 
Are you using stream rules to route messages to stream? Then you should check the order of your message processors in graylog. See this thread, migh tbe the same problem?
Hi @smolit,
i’ll have a guess. Are you using stream rules to route messages to stream? Then you should check the order of your message processors in graylog. See this thread, migh tbe the same problem?