```
The pipeline I’m working on is connected to a stream that pulls messages (removes them) from All messages, and it has its own index. Not sure if that makes a difference.
Thanks,
Guy
---
### Author:  [@jochen](https://community.graylog.org/u/jochen)
#### Post date: [October 17, 2017, 9:09am UTC](https://community.graylog.org/t/pipeline-rule-not-working/2802/2 "2017-10-17T09:09:34Z")
Please post the complete logs of your Graylog node(s) and the list of installed plugins including their versions (see System / Nodes / Details in the web interface).
---
### Author:  [@knightsg](https://community.graylog.org/u/knightsg)
#### Post date: [October 18, 2017, 5:46pm UTC](https://community.graylog.org/t/pipeline-rule-not-working/2802/3 "2017-10-18T17:46:34Z")
Sure. Here’s a link to the server log: [https://fr.pastebin.ca/3891544](https://fr.pastebin.ca/3891544)
The installed plugins:
Anonymous Usage Statistics 2.3.1
AWS plugins 2.3.1
Collector 2.3.1
Elastic Beats Input 2.3.1
Enterprise Integration Plugin 2.3.1
MapWidgetPlugin 2.3.1
PagerDuty Alarmcallback plugin 1.3.0
Pipeline Processor Plugin 2.3.1
---
### Author:  [@knightsg](https://community.graylog.org/u/knightsg)
#### Post date: [October 18, 2017, 6:48pm UTC](https://community.graylog.org/t/pipeline-rule-not-working/2802/4 "2017-10-18T18:48:54Z")
I should just mention that in the interests of brevity I stopped Graylog and removed the existing server log file before restarting Graylog and letting it run for a while. So there are no examples of the [DeadEventLoggingListener] warning I mentioned earlier in the log I posted above.
---
### Author:  [@jochen](https://community.graylog.org/u/jochen)
#### Post date: [October 19, 2017, 7:16am UTC](https://community.graylog.org/t/pipeline-rule-not-working/2802/5 "2017-10-19T07:16:01Z")
Try removing the AWS plugin and the PagerDuty plugin and try again.
---
### Author:  [@knightsg](https://community.graylog.org/u/knightsg)
#### Post date: [October 30, 2017, 8:49pm UTC](https://community.graylog.org/t/pipeline-rule-not-working/2802/6 "2017-10-30T20:49:17Z")
I can try removing the PD plugin but the AWS plugin is the source of the log messages (AWS flow logs).
FYI, I am now working with a new installation of Graylog (it was a test setup I was playing with) since my original message, and I still can’t get this to work. My actual intent is to route messages from one stream to another (which is not working), but I have also added a debug statement and it’s not outputting anything to the log either. I changed the log level to debug but still no luck.
This is my current rule:
```
rule "filter RDS"
when
has_field("account_name") && $message.dst_port == 3306
then
let stream_name = concat(capitalize(to_string($message.account_name)), " RDS");
debug(to_string(stream_name));
route_to_stream(name: to_string(stream_name));
end
```
For the record, I have another pipeline with the following rule that uses a lookup table to add a field and it’s working fine:
```
rule "add aws account name"
when
has_field("account_id")
then
let acc_name = lookup_value("aws-account-names", $message.account_id);
set_field("account_name", acc_name);
end
```
However the above pipeline rule is attached to the “All messages” stream while the one I’m having problems with is connected to other streams. The other streams successfully move logs from “All messages” so there are messages in the source streams, it just seems like this pipeline is doing nothing.
---
### Author:  [@jan](https://community.graylog.org/u/jan)
#### Post date: [November 6, 2017, 8:01am UTC](https://community.graylog.org/t/pipeline-rule-not-working/2802/7 "2017-11-06T08:01:10Z")
@knightsg
did you check if the field `$message.dst_port` is actually validated?
you need to give the information what is inside the field:
```auto
rule "filter RDS"
when
has_field("account_name") && to_string($message.dst_port) == "3306"
then
let stream_name = concat(capitalize(to_string($message.account_name)), " RDS");
debug(to_string(stream_name));
route_to_stream(name: to_string(stream_name));
end
```
should work
---
### Author:  [@system](https://community.graylog.org/u/system)
#### Post date: [November 20, 2017, 8:01am UTC](https://community.graylog.org/t/pipeline-rule-not-working/2802/8 "2017-11-20T08:01:34Z")
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.