I need some help with the route_to_stream function of the pipeline processor.
I am currently playing around with graylog and the pipeline processor to enrich the log messages. The first is that I want to route message of certain applications into separate streams. For this I created a new stream and created the following rule:
rule "route test" when has_field("application") && to_string($message.application) == "test" then route_to_stream(id: "58cc0a2e2bf0923e5c4b4acc"); end
If I connect the pipeline using this rule with the main stream graylog stops processing incoming messages. The process buffer starts growing and if it is full the disk journal… No error message in the logs and the trace messages I activated for the pipeline plugin looks fine for me, as well. Probably I don’t see it. Using the streams name had the same result and the stream is in running state.
I get the stream id on the streams “details page” from the browser url …/streams/58cc0a2e2bf0923e5c4b4acc/search. Would not know about a better place or another thing looking like the ID.
The graylog version is the current one. Version 2.2.2
It would be great if someone could help me.