# Remove matches from All messages stream

**URL:** <https://community.graylog.org/t/remove-matches-from-all-messages-stream/3016>\
**Category:** Graylog Central (peer support)\
**Created:** [November 2, 2017, 12:23pm UTC](https://community.graylog.org/t/remove-matches-from-all-messages-stream/3016 "2017-11-02T12:23:44Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![RochonC](https://avatars.discourse-cdn.com/v4/letter/r/a4c791/32.png) [@RochonC](https://community.graylog.org/u/RochonC)\
**Post date:** [November 2, 2017, 12:23pm UTC](https://community.graylog.org/t/remove-matches-from-all-messages-stream/3016/1 "2017-11-02T12:23:44Z")

</div>

Why is the option ‘Remove matches from ‘All messages’ stream’ not checked in the 4 OOTB streams: nginx HTTP 404s, nginx HTTP 4XXs, nginx HTTP 5XXs, nginx requests. Does this means that for one input message, it’s now found in All messages AND depending on the message values & rules evaluation, could be found in one of the streams: nginx HTTP 404s, nginx HTTP 4XXs, nginx HTTP 5XXs, nginx requests ?

For example, if the input message contains:  
• Field source = nginx  
• Field response\_status = 404

…will the message be found in 4 streams: All messages, nginx HTTP 404s, nginx HTTP 4XXs, nginx requests ? Is this 4 copies of the same input message ending up in the ‘Default index set’ ?

---

<div class="post-metadata">

**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\
**Post date:** [November 2, 2017, 4:46pm UTC](https://community.graylog.org/t/remove-matches-from-all-messages-stream/3016/2 "2017-11-02T16:46:34Z")

</div>

> [@RochonC](#):
>
> Does this means that for one input message, it’s now found in All messages AND depending on the message values & rules evaluation, could be found in one of the streams: nginx HTTP 404s, nginx HTTP 4XXs, nginx HTTP 5XXs, nginx requests ?

Yes, exactly.

> [@RochonC](#):
>
> Is this 4 copies of the same input message ending up in the ‘Default index set’ ?

No.

Please refer to [http://docs.graylog.org/en/2.3/pages/streams.html](http://docs.graylog.org/en/2.3/pages/streams.html) and [http://docs.graylog.org/en/2.3/pages/configuration/index\_model.html](http://docs.graylog.org/en/2.3/pages/configuration/index_model.html) for information about streams and the underlying index model used by Graylog.

---

<div class="post-metadata">

**Author:** ![RochonC](https://avatars.discourse-cdn.com/v4/letter/r/a4c791/32.png) [@RochonC](https://community.graylog.org/u/RochonC)\
**Post date:** [November 2, 2017, 7:27pm UTC](https://community.graylog.org/t/remove-matches-from-all-messages-stream/3016/3 "2017-11-02T19:27:58Z")

</div>

Thanks for your reply. If I got it right, the ‘Remove matches from ‘All messages’ stream’ option becomes handy when the stream(s) where a message end up in, uses a different ‘index set’ than the ‘Default index set’ and we don’t want the message written in both index set.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [November 16, 2017, 7:28pm UTC](https://community.graylog.org/t/remove-matches-from-all-messages-stream/3016/4 "2017-11-16T19:28:03Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.