I understand there is a stream called All events. I would like to route all graylog events that are alerts into another stream. I have tried creating the following pipeline rule but no messages have been coming through. The ‘remove matches from all messages stream’ is disabled for the All events stream too.
rule "Write: Alert Stream" when has_field("alert") and contains(to_string($message.alert), "true") then //route the message to the stream and index route_to_stream(name: "Alert Stream"); end