# Pipeline rule to split log messages into key-value fields not working

**URL:** <https://community.graylog.org/t/pipeline-rule-to-split-log-messages-into-key-value-fields-not-working/25386>\
**Category:** Graylog Central (peer support)\
**Tags:** pipeline-rules, sidecar, filebeat-linux\
**Created:** [August 22, 2022, 9:36am UTC](https://community.graylog.org/t/pipeline-rule-to-split-log-messages-into-key-value-fields-not-working/25386 "2022-08-22T09:36:31Z")\
**Posts on this page:** 1\
**Showing post:** 12

<div class="post-metadata">

**Author:** ![mpfz0r](https://avatars.discourse-cdn.com/v4/letter/m/eb9ed0/32.png) [@mpfz0r](https://community.graylog.org/u/mpfz0r)\
**Post date:** [August 24, 2022, 1:18pm UTC](https://community.graylog.org/t/pipeline-rule-to-split-log-messages-into-key-value-fields-not-working/25386/12 "2022-08-24T13:18:39Z")

</div>

The default order is an unfortunate oversight. It is ordered alphabetically (with the full class name)  
For a long time we didn’t dare to change the default, because it will break the processing  
of existing setups.  
The next release will have the order fixed. (But only for new installations)  
See [Define a new improved default message processing order by mpfz0r · Pull Request #13081 · Graylog2/graylog2-server · GitHub](https://github.com/Graylog2/graylog2-server/pull/13081)  
for details.

Also of Note: The stream rules are become a separate message processor:

> <https://github.com/Graylog2/graylog2-server/pull/13256>
>
> Matching (routing) Messages into streams used to happen within the
> MessageFilte…rChainProcessor and was run as the last filter.
> 
> Making Stream Matching a separate Message Processor gives the users
> more flexibility. They can for instance run pipeline and extractors first,
> and perform stream assignment last.
> 
> Fixes #6464

---

_[View the full topic](https://community.graylog.org/t/pipeline-rule-to-split-log-messages-into-key-value-fields-not-working/25386)._