Stream message do not show

Graylog Central (peer support)
1

Hi Guys,

I saw the message was route to stream.
image
But when I choice the stream and click search nothing will show ?

2

Please post the actual stream rules and an example message that should be caught by it.

It is also possible that the timestamp on the message is off, such as a different time zone from the console viewing you are doing.

3

@tmacgbay
Thanks for your reply.

  1. The message always route to “All messages” stream
  2. My rule and message sampe as below
    image

image
image970×300 109 KB

image

  1. There is another stream work noramally.
4

You could try using regex there

Message must match regular expression: ^kind\:s7

where the ^ enforces beginning of message and the \ next to the colon escapes it to be exact.

5

@tmacgbay
But the system was show “This message would be routed to this stream!”
As I know, that mean the rule is correct.
Am I right ?

6

Hello,

What happens when you adjust the Search time? Maybe something beyond 5 minutes.

image

I also noticed that the time in the Message does not match the "timestamp " field. perhaps insure the Date/time ( & timezone) is correct. Not only on the server but the user and remote devices also has the correct timezone.