Use Stream Name and remove_from_default in route_to_stream()

The documentation for the route_to_stream() Pipeline function isn’t clear on how to use only the stream name and set the remove_from_default parameter. Here’s a few calls I’ve tried, but the editor gives me various issues for each:

  • route_to_stream("Stream Name", true);
  • route_to_stream("Stream Name", "", $message, true);
  • route_to_stream("Stream Name", , , true);
  • route_to_stream("Stream Name", $message, true);

Any ideas how I’m supposed to use this function? Unfortunately I’m needing to move all of our stream routing into Pipeline rules because we need some processing before stream routing, and some after the routing.

I found that half my problem was in the API (see issue #5223: https://github.com/Graylog2/graylog2-server/issues/5223). However, this still doesn’t change that this function is fairly undocumented, especially when referencing a stream by the name, and removing the message from the default stream.

This is an alternative I’ve come up with in the mean time:

route_to_stream("Stream Name", "", clone_message());
drop_message();

I feel like it adds unnecessary overhead for message processing, but it gets the job done for now.

Edit: don’t set remove_from_default to true with this method, because the message is never in the default stream to start with, and you’ll get warnings in the Graylog log file on the filesystem.

You did not include what Graylog Version you are using … but for 2.4.6 I would look at the tests how they used this function:

In your case the following would be the way to go:

That’ll do it! Thanks!

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.