I want to get alert emails in certain circumstances that the out of the box alert system does not support (using AND's and OR's). I'm trying to use a pipeline to take messages from one stream and put them into another. The rules in the pipeline can filter the messages for me and then I would be able to use the standard alerts on the second stream.
I'm having trouble getting messages from the pipeline to show up in the 2nd stream. The first stream has messages coming through. Below is the pipeline which will intentionally send everything to the second stream (just to get something to show up) rule "is error or warning message" when true then set_field(field: "facility", value: "alertMsg"); route_to_stream(name: "Listener - Pre Prod Alerts"); end in the stream "Listener - Pre Prod Alerts" there is one rule: * facility must match exactly alertMsg* I've connected this pipeline to the 1st stream and I see in the UI that there are messages going through it in the metrics column. Below is a sample message that seems like it should end up in the second stream: ExceptionMessage error while getting locationid LoggerName debug facility console-runner full_message System.Exception: error while getting locationid ---> System.ArgumentException: An item with the same key has already been added. at System.ThrowHelper.ThrowArgumentException(ExceptionResource resource) at System.Collections.Generic.Dictionary`2.Insert(TKey key, TValue value, Boolean add) at EHospitalDataUpdaterListener.Logging.findLocationID(MessageQueueItem messageQueueItem) in C:\Dev\CCF\EHospital\EHospitalDataUpdaterListener\Logging.cs:line 171 --- End of inner exception stack trace --- level 3 message System.Exception: error while getting locationid ---> System.ArgumentException: An item with the same key has already been added. at System.ThrowHelper.ThrowArgumentException(ExceptionResource resource) at System.Collections.Generic.Dictionar source CC-CLEHOSP56 timestamp 2016-09-22T17:18:22.197Z I'm missing something but I have no idea what. Does anyone have any ideas or suggestions? thanks -- You received this message because you are subscribed to the Google Groups "Graylog Users" group. To unsubscribe from this group and stop receiving emails from it, send an email to graylog2+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/graylog2/d75d6e3a-018c-4720-a544-44fb8528f4d8%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
