For some IMHO stupid reason, (pipeline) rule changes:
- do become effective in the simulator intermediately … however
- do take, in my case one hour, before the changed rules are processed
That is NOT OK of course.
From the internet I get the impression that it has something to do with time zone’s. However what ever the reason is, it should simple not occur.
- I am running the very latest version of graylog and opensearch
- graylog: root_timezone = Europe/Amsterdam
- open search: I did not change time zone settings in Open Search
- I did not change time zone in MongoDB
- linux (ubuntu) time is UTC
In my opinion this behavoir is a bug, I can not see it another way. But apart from that I need help to solve the problem.
Config changes should of course become effective intermediately.