Good day, I’ve been trying to figure out if there is a way to create a stream rule based on a string within the message body. I’ve looked through the internet and haven’t been able to find anything. I’m able to sort my results on the elastic search with wildcard within the message body however fo…

You can use the “contain” filter for your stream rules.[streamedit]

The “contains” condition has been added in Graylog 2.1.2. [joschi] Implement "contains" stream rule by joschi on 11:08AM - 02 Nov 16 UTC 1 commits changed 6 files with 205 additions and 20 deletions.

Use 2.3 There are many cool enhancements made.

Thanks, I’m sold on the idea of new enhancements. =)

Stream Rule - is wildcard possible

Graylog Central (peer support)

anonymous1 November 27, 2017, 3:16pm 3

Hi Sachin,

thanks. Which version of graylog are you using? I don’t have contain as a selection? I’m using graylog 2.0

screenshot

Cheers,
Johnny

Topic		Replies	Views
How to How you create custom field Graylog Central (peer support)	16	4891	December 18, 2017
How to create Stream Rule for containers Graylog Central (peer support)	16	6665	November 8, 2017
Stream Rule Creation Graylog Central (peer support) pipeline-rules , route-to-streampl	5	3456	April 16, 2021
Help streams-rules Graylog Central (peer support)	4	471	February 22, 2021
Configuration of streams Graylog Central (peer support) pipeline-rules , route-to-streampl	9	3490	July 15, 2020

Stream Rule - is wildcard possible

Related topics