Stream Rules doesn't work

Graylog Central (peer support)
1

Hi,

I create a stream for all switch logs.
I want to redirect all switch on this stream.
It is possible to create a rule condition for many source IP ?

Example : i have 2 ip for switch (192.0.6.3 and 10.100.0.2)
i try this but it’s doesn’t work

image

2

nobody know ?
Nobody can help me

3

I could be wrong but I don’t believe that’s a valid regex pattern. Might be simpler if you do 2 rules for the stream, Field=Source, Type=Match Exactly, Value=192.0.6.3. Second rule of course matching on 10.100.0.2. Then for Step 2 of your stream rules ensure you have “A message must match at least one of the following rules” selected. If your switch might be logging from one or the other of those IP’s.

I know you can use operators such as AND or OR in a Pipeline rule, or a Lucene query, but not a regex pattern.

4

Thank you.
It’s work fine.

5

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.