Route to stream - Forwarder Input

Graylog Central (peer support)
1

I have a Graylog Forwarder. I want to route the input from the Graylog Forwarder into a stream. Right now the logs arrive in the Default Stream.

For normal inputs, I make pipeline rules with the route to stream function.
Based on the input id or other fields, such as data path of the logs.
E.g.

rule "route to stream x"
when
    from_input(id:"64edf8eede67ea565c9ac431")
then
    route_to_stream(id: "64f6f1dba00f8f218c010726", remove_from_default: true);

I tried the same pipeline rule for the Graylog forwarder. However, I used the id of the Forwarder Input in Graylog itself, which did not work.

After that I tried to use the input id of the input opened on the Forwarder side itself (Input Profile). Which did not work either.

My logs from the Forwarder still arrive in the Default Stream.

How am I able to get the Input from the Forwarder into a specific steam? Thank you.

2

What version of Graylog are you running?

3

At the moment we run 5.1.2

4

How fine grained does it need to be, do you have more than one forwarder running the same input profile with the same inputs?

5

I would look at one of the messages that should have been routed, and see the vaoues for these two fields.

gl2_source_input (this is the input from the input profile, this id will be the same across all forwarders with the same profile applied)
gl2_source_node (this should be the unique forwarder or node of the cluster that the message was delivered to.)

The two of those combined should get your routing working.

2 Likes
6

It has not to be fine grained. Just one Forwarder with one Input Profile (having two inputs)

Ok.
gl2_source_input i do find easily: 6527b2eb296e5515b87192fc
gl2_source_node would be: 89b10b61-d650-49a4-a04b-82b99efca907

The problem is, how to combine them both?

7

very easy :wink:

rule "route to stream x"
when
    to_string($message.gl2_source_input) == "6527b2eb296e5515b87192fc" AND
    to_string($message.gl2_source_node) == "89b10b61-d650-49a4-a04b-82b99efca907"
then
    route_to_stream(id: "64f6f1dba00f8f218c010726", remove_from_default: true);
2 Likes
8

^ what @ihe said!!!

9

Thank you very much for your help @Joel_Duffield and @ihe . It is working now.

1 Like
10

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.