Stream does not write records to new index

I created a new index under Graylog

I created the input as follows with an additional static field “log_type:wazuh”
The static field “log_type:wazuh” is also included in incoming messages.

Now I have created a stream that should write the incoming messages with the field “log_type:wazuh” to the index “wazuh”. For this purpose, I added the corresponding rule to the stream. Unfortunately, the incoming messages are still written to the default index

Where is my mistake?


Hey @david81

Not sure what going on with route to stream. If you referring to default stream “All Messages” ( Default) I personally would use a pipeline , attach it to default stream, point it to stream called " Wazuh".

rule "route to stream wazuh"
    route_to_stream(id: "64f6f1dba00f8f218c010726", remove_from_default: true);

Thanks @gsmith this soloution works for me

1 Like

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.