Rename index set backing "All messages" stream?

Graylog Central (peer support)
, ,
9

@tmacgbay - Yes, keeping fingers crossed that your call for devs will succeed.
I don’t want my rules to accidentally depend on accidental/unstable behavior.

@gsmith - nice idea. Unfortunately it is giving me just errors

pipeline-simulator
pipeline-simulator930×190 15.2 KB

I figured out it dislikes my standard timestamp sanitization rule:

rule "Timestamp sanitizer (not ± 30 minutes)"
when
    to_date($message.timestamp) - minutes(30) > now() || 
    to_date($message.timestamp) + minutes(30) < now()
then
  set_field("timestamp_wrong", to_date($message.timestamp));
  set_field("timestamp", now());
end

-----------------------------------------------------------------

PS: The solution to my original question is trivial - assuming you avoid routing in pipelines like I do.
Just create a stream “All messages (Editable)” and attach this one-liner rule to All messages:

route_to_stream(name: "All messages (Editable)", remove_from_default: true);