Stream messages does not hit pipeline

[mulgurul (Peter Meldgaard)]

I’m strugling with this weird problem. I might have starred me blind, so need a little help from vice guys.

I have a stream with two simple rules. I have tested against the test messages arriving, they all pass.
When I send a bunch of messages, then I can see the stream mess. per second go up.

So I must assume that the stream works and is filtering correctly. When I look at messages with search I can see that they are sent into the stream:

Now I want to prcess them in a pipeline. So I created a pipeline, and connected it to the stream.
I added one rule to stage 1. The rule is always executed/true

when
  true
then
  set_field("TestKey", "TestVal");
end

But when I send in messages through the stream, they are not processed by the pipeline. I cant see the message throughput go up, and no messages are processed/changes by the rule.

If I connect the rule to the “All messages” stream then the pipeline works, and messages are processed.

I’m totally blank with regards to what I’m doing wrong? Someone have a suggestion?

BR Peter

[jan (Jan Doberstein)]

He Peter,

what is your processing oder in System > configuration ? If the processing pipeline is BEFORE the message filter chain it will not work.

http://docs.graylog.org/en/2.5/pages/pipelines/usage.html

[mulgurul (Peter Meldgaard)]

Wow you nailed it in less than 30 minutes from posting questions…

Ok I remember to have seen information about this “process order” somewhere in the documentation, But had forgotten everything about it.

Thanks so much Jan, for making this a better day here in grey and cold Denmark. Cheers:-)

BR Peter