# Rules, order of execution **URL:** \ **Category:** Graylog Central (peer support)\ **Tags:** pipeline-rules\ **Created:** [February 18, 2022, 1:17pm UTC](https://community.graylog.org/t/rules-order-of-execution/22705 "2022-02-18T13:17:26Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![danmassa7](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/danmassa7/32/9723_2.png) [@danmassa7](https://community.graylog.org/u/danmassa7)\ **Post date:** [February 18, 2022, 1:17pm UTC](https://community.graylog.org/t/rules-order-of-execution/22705/1 "2022-02-18T13:17:26Z")
I have a question about what order the rules execute in a particular stage. Can you conceptually view all rules within a stage as happening in parallel? Or are they guaranteed to run sequentially in the order listed? If they run in the listed sequence, should there be a feature enhancement request to be able to change the order the rules are listed in the UI? Or am I missing something, because the only way to change the order is to start dumping rules out and then adding them back in. Thanks. ### Operating system information centos-linux-release-8.3-1.2011.el8.noarch ### Package versions - Graylog 4.0.7 - MongoDB 4.2.14 - Elasticsearch 7.10.2 ---
**Author:** ![nisow95612](https://avatars.discourse-cdn.com/v4/letter/n/3d9bf3/32.png) [@nisow95612](https://community.graylog.org/u/nisow95612)\ **Post date:** [February 18, 2022, 2:25pm UTC](https://community.graylog.org/t/rules-order-of-execution/22705/2 "2022-02-18T14:25:33Z")
I believe they run in parallel. What would otherwise be the purpose of “stages”? However, I have no idea how graylog handles conflicts between these rules. I expected to find the answer at [Pipelines — Graylog 2.4.6 documentation](https://archivedocs.graylog.org/en/2.4/pages/pipelines/pipelines.html), but didn’t. I guess the fastest way is to run some experiments with the [Pipeline simulator](https://archivedocs.graylog.org/en/2.4/pages/pipelines/usage.html#simulate-your-changes) ? Heads up: Pipeline simulator may fail if your rules modify timestamp - [details here](https://community.graylog.org/t/rename-index-set-backing-all-messages-stream/21425/9). ---
**Author:** ![tmacgbay](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/tmacgbay/32/3878_2.png) [@tmacgbay](https://community.graylog.org/u/tmacgbay)\ **Post date:** [February 18, 2022, 7:32pm UTC](https://community.graylog.org/t/rules-order-of-execution/22705/3 "2022-02-18T19:32:12Z")
Although it is described in documentation, it still wasn’t clear to me (always take me longer!) so I did some testing on this. Rules in a stage are generally run in parallel - or at least you should assume so. If you want Rule\_A to run before Rule\_B you need to make sure that Rule\_B is in a higher numeric stage number (stages can be numerically negative). If you shunt the message to another pipeline via a command in it’s current pipeline, the message will finish all commands and stages in the current pipeline, and THEN it will start the next pipeline you send it to. HOWEVER. If you have a message that starts traversing two or more pipelines at the same time, stages run in lockstep/parallel. So a message would execute all rules in `Pipeline_D stage 1` and `Pipeline_E stage 1` before it would execute any rules in any subsequent stages… and so on. This means that if `Pipeline_E` did not have a stage two and `pipeline_D` did (and they both had a `stage 3`) then the rules in `pipleine_D stage 2` would run and then both pipelines would run `stage 3` in parallel. Oy, that is a lot of words… ---
**Author:** ![danmassa7](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/danmassa7/32/9723_2.png) [@danmassa7](https://community.graylog.org/u/danmassa7)\ **Post date:** [February 18, 2022, 7:58pm UTC](https://community.graylog.org/t/rules-order-of-execution/22705/4 "2022-02-18T19:58:47Z")
@tmacgbay, Gotcha. Thank you for the detailed description. ---
**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\ **Post date:** [March 4, 2022, 7:58pm UTC](https://community.graylog.org/t/rules-order-of-execution/22705/5 "2022-03-04T19:58:48Z")
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.