Routing Messages Across Streams and Index Sets

Graylog Central (peer support)
,
1

Hello,

I’m currently having issues with duplicated messages.

I currently have two Streams

Stream A with Index Set A
Stream B with Index Set B

The idea is that Steam A (using stream rules) first receive the messages.
Then, a pipeline is connected to Stream A to route_to_stream messages that match a condition to Stream B.
The behavior I observed was, the message will be indexed in both IndexSet A and IndexSet B.
The behavior I was hoping is that the message only gets indexed at IndexSet B

I’ve tried several things.

  1. route_to_stream(Stream B) then drop() on the same rule. however the messages are being dropped on both streams.
  2. let new_message = clone() then route_to_stream(new_message) then drop() caused the graylog servers to crash.

Do you have any recommendations on how to get the messages to StreamB from StreamA?
Unfortunately, as much as possible we do not want to add stream rules to StreamB .

Thank you

1 Like
2

Hej Jan,

you need the route_to_stream function and the remove_from_stream. Your rule would be:

then
 route_to_stream(Stream b)
 remove_from_stream(Stream a)
3

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.