Using contains function with remove_from_stream

Graylog Central (peer support)
1

I have created a rule that routes matches to a certain stream and then uses the remove_from_default function (see below):

route_to_stream(name: “StreamName”, remove_from_default: true);

I want to also make it so that the rule removes the events from all other streams, but I am not sure how to best accomplish this. Is there a way to use a wildcard and contains with the remove_from_stream function or is there a better method for accomplishing this?

2

he @reconluke

currently the only option is to write one line remove_from_stream(STREAM_ID) per stream that you want to have removed.

It would be a feature request to make a new function that does remove_from_all_streams_but_not(STREAMID) or similar.

Do you mind adding this as feature request over at github?

3

Thanks Jan, I have put in a feature request for this.

4

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.