I think I am confused a bit and need an additional explanation:
Let`s say i have 3 streams:
All Messages (default one ) - all messages in this stream are written to default index set (graylog_)
Appservers - all messages in this stream are written to appservers_ index set
Prxservers - all messages in this stream are written prxsrv_* index set.
When I created these two additional streams, I have chosen separate index for each stream. I am quite not sure about option ‘Remove matches from All Messages . stream’. When i NOT using this option, does it mean that message is going to be writeen to both index sets: the default one (graylog_*) and the dedicated one for the stream itself ? i.e: Do i have explicitly check this option to avoid message duplication across different indices ?
Thanks in advance
