Jochen- The rule works now thanks to your clarifications, but now I've got a new question:
When I apply the pipeline with that rule to the App 1 stream (matches exactly on "source: app 1"), it doesn't forward anything to my tomcat stream. Even when I set the condition to true to let everything through, nothing happens. However, the routing happens when applied to the default stream. Why would that be the case? As I understand the documentation, the pipeline should be applied to a message once it hits a stream, so I'm confused why it only works on the default stream. -Ross On Friday, April 29, 2016 at 4:01:23 AM UTC-4, Jochen Schalanda wrote: > > Hi Ross, > > you need to tell the route_to_stream function whether you're specifying > the *stream id* or the *stream name*, see > https://github.com/Graylog2/graylog-plugin-pipeline-processor/blob/1.0.0-beta.2/src/test/resources/org/graylog/plugins/pipelineprocessor/functions/newlyCreatedMessage.txt#L10 > > for an example and > http://docs.graylog.org/en/2.0/pages/pipelines/functions.html#route-to-stream > for the function documentation. > > Personally, I would recommend using the *stream id* to make the rules > less brittle if someone renames the stream. > > Cheers, > Jochen > > On Thursday, 28 April 2016 22:56:25 UTC+2, Ross wrote: >> >> Hi- >> >> I'm trying to create a pipeline to send messages to another stream based >> on the application that generated it. In the message, that's represented in >> the tag field. All I need is a simple string comparison, but I can't figure >> out how to access the actual values of the fields. I've tried the following >> two rules to no avail: >> >> rule "app_1_tomcat" >> when >> contains(to_string(message.tag), "tomcat") >> then >> route_to_stream("App 1 Tomcat"); >> end >> >> rule "app_1_tomcat" >> when >> message.tag == "tomcat" >> then >> route_to_stream("App 1 Tomcat"); >> end >> >> The stream that is attached to this pipeline only matches on App 1, the >> pipeline is only attached to that stream, and one of the above rules is the >> only rule attached to the pipeline. What am I missing? >> >> Let me know if there's any information I can fill in. >> >> -Ross >> > -- You received this message because you are subscribed to the Google Groups "Graylog Users" group. To unsubscribe from this group and stop receiving emails from it, send an email to graylog2+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/graylog2/bafaa088-395f-4c47-b71b-c7f71016a2ee%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
