Re: [graylog2] Pipeline doesn't drop message unless attached to Default stream
Hej Alex, Yes that was it, thanks. I never touched that order, so I guess it has been changed/created through upgrades. Maybe it would be worth to add this information (about required processing order for pipelines) to pipeline's documentaiton. This is already part of the documentation: http://docs.graylog.org/en/2.1/pages/pipelines/usage.html#configure-the-message-processor but that might not be prominent enough … /jd -- You received this message because you are subscribed to the Google Groups "Graylog Users" group. To unsubscribe from this group and stop receiving emails from it, send an email to graylog2+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/graylog2/etPan.57de708b.4b2a8603.3a1%40jalogisch.de. For more options, visit https://groups.google.com/d/optout. signature.asc Description: Message signed with OpenPGP using AMPGpg
Re: [graylog2] Pipeline doesn't drop message unless attached to Default stream
Hej Alex, Processing order looks fine to me https://i.imgur.com/4oIEcvB.png Try it with the changed order: /jd -- You received this message because you are subscribed to the Google Groups "Graylog Users" group. To unsubscribe from this group and stop receiving emails from it, send an email to graylog2+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/graylog2/etPan.57db9ef2.6901545d.3a1%40jalogisch.de. For more options, visit https://groups.google.com/d/optout. signature.asc Description: Message signed with OpenPGP using AMPGpg
Re: [graylog2] Pipeline doesn't drop message unless attached to Default stream
Processing order looks fine to me https://i.imgur.com/4oIEcvB.png Input config https://i.imgur.com/nsmzx7S.png Stream Rule https://i.imgur.com/N5gUdDj.png Pipelines https://i.imgur.com/O7Pkvbi.png Pipeline config https://i.imgur.com/M6lBpy8.png Stage 0 config https://i.imgur.com/eh396Vj.png One thing I noticed: If I attach pipeline to *Syslog *stream and remove it from *Default, * https://i.imgur.com/6W709FI.png current throughput goes down to 0 msg/s. Looks like messages are not even going through (although there are several messages in the stream). > > https://i.imgur.com/gbxnkMF.png Alexander -- You received this message because you are subscribed to the Google Groups "Graylog Users" group. To unsubscribe from this group and stop receiving emails from it, send an email to graylog2+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/graylog2/b588e3e5-401c-48be-a25d-ae1fd66dc708%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
[graylog2] Pipeline doesn't drop message unless attached to Default stream
Not sure if it's a bug or my misunderstanding of documentation.
I have a pipeline with following rule in it
rule "drop cronjob"
when
has_field("application_name") && to_string($message.application_name) ==
"CRON"
then
drop_message();
end
If I attach this pipeline to "Syslog" stream, messages are not dropped, and
I still can see them in the stream. Only if I attach the pipeline to Default
stream,
messages begin to be dropped.
Currently it's the only pipeline present in the system, it contains only
one rule, and it's on stage 0.
Stream *Syslog* is populated through "normal" way (Stream rules, filtering
by gl2_source_input).
Any thoughts?
--
You received this message because you are subscribed to the Google Groups
"Graylog Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to graylog2+unsubscr...@googlegroups.com.
To view this discussion on the web visit
https://groups.google.com/d/msgid/graylog2/1f25535a-46d5-4892-b07a-a1994d7028f3%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.
