Routing Graylog Events into Another stream

Graylog Central (peer support)
,
1

I understand there is a stream called All events. I would like to route all graylog events that are alerts into another stream. I have tried creating the following pipeline rule but no messages have been coming through. The ‘remove matches from all messages stream’ is disabled for the All events stream too.

rule "Write: Alert Stream"
when
    has_field("alert")
    and contains(to_string($message.alert), "true")
then
    //route the message to the stream and index
    route_to_stream(name: "Alert Stream");

end
2

he @sunicod

you can’t do processing on the events stream as those messages are not processed like normal messages. You can’t move them out of that desired events stream.

3

Thank you for confirming.

4

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.