Jochen- The rule works now thanks to your clarifications, but now I've got a new question:
When I apply the pipeline with that rule to the App 1 stream (matches exactly on "source: app 1"), it doesn't forward anything to my tomcat stream. Even when I set the condition to true to let everything through, nothing happens. However, the routing happens when applied to the default stream. Why would that be the case? As I understand the documentation, the pipeline should be applied to a message once it hits a stream, so I'm confused why it only works on the default stream. -Ross On Friday, April 29, 2016 at 4:01:23 AM UTC-4, Jochen Schalanda wrote: > > Hi Ross, > > you need to tell the route_to_stream function whether you're specifying > the *stream id* or the *stream name*, see > https://github.com/Graylog2/graylog-plugin-pipeline-processor/blob/1.0.0-beta.2/src/test/resources/org/graylog/plugins/pipelineprocessor/functions/newlyCreatedMessage.txt#L10 > > for an example and > http://docs.graylog.org/en/2.0/pages/pipelines/functions.html#route-to-stream > for the function documentation. > > Personally, I would recommend using the *stream id* to make the rules > less brittle if someone renames the stream. > > Cheers, > Jochen > > On Thursday, 28 April 2016 22:56:25 UTC+2, Ross wrote: >> >> Hi- >> >> I'm trying to create a pipeline to send messages to another stream based >> on the application that generated it. In the message, that's represented in >> the tag field. All I need is a simple string comparison, but I can't figure >> out how to access the actual values of the fields. I've tried the following >> two rules to no avail: >> >> rule "app_1_tomcat" >> when >> contains(to_string(message.tag), "tomcat") >> then >> route_to_stream("App 1 Tomcat"); >> end >> >> rule "app_1_tomcat" >> when >> message.tag == "tomcat" >> then >> route_to_stream("App 1 Tomcat"); >> end >> >> The stream that is attached to this pipeline only matches on App 1, the >> pipeline is only attached to that stream, and one of the above rules is the >> only rule attached to the pipeline. What am I missing? >> >> Let me know if there's any information I can fill in. >> >> -Ross >> > -- You received this message because you are subscribed to the Google Groups "Graylog Users" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/graylog2/bafaa088-395f-4c47-b71b-c7f71016a2ee%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
