My graylog cluster is running 3.0.2 atm, upgrading soon.
I am trying to do something that seems fairly simple. I have a stream that matches all messages that are coming from the F5 ASM, they are assigned a unique index and all is working treat there.
There are two very large fields that I want in the short term, but want to drop in the long term to save space.
Retention on my “All Messages” stream is short and will keep the full entry.
I have a pipeline attached to the ASM stream where I am removing the large field.
The problem is that it is removing it from BOTH the All and the ASM streams.
Since my pipeline processing is after Message Filter Chain I thought pipeline processing would not touch the All stream unless I explicitly attached it to that stream.
Message Processors Configuration
The following message processors are executed in order. Disabled processors will be skipped.
|1||Message Filter Chain||active|
|4||AWS Instance Name Lookup||active|
Thanks for the help!