Stream does not write records to new index

[david81 (David)]

Hello,
I created a new index under Graylog

I created the input as follows with an additional static field “log_type:wazuh”
The static field “log_type:wazuh” is also included in incoming messages.

Now I have created a stream that should write the incoming messages with the field “log_type:wazuh” to the index “wazuh”. For this purpose, I added the corresponding rule to the stream. Unfortunately, the incoming messages are still written to the default index

Where is my mistake?

Thanks
David

[gsmith]

Hey @david81

Not sure what going on with route to stream. If you referring to default stream “All Messages” ( Default) I personally would use a pipeline , attach it to default stream, point it to stream called " Wazuh".

rule "route to stream wazuh"
when
    has_field("log_type")
then
    route_to_stream(id: "64f6f1dba00f8f218c010726", remove_from_default: true);

[david81 (David)]

Thanks @gsmith this soloution works for me