Graylog2 / Graylog2/graylog2-server
Allow creating started stream through API
- Dominant language
- Java
- Stars
- 8.1k
- Forks
- 1.1k
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 217
Description
## Expected Behavior
When creating a stream, I should be able to create the stream and enable it upon creation.
## Current Behavior
When creating a stream, I cannot use the attribute `"disabled": false` when creating the stream.
## Steps to Reproduce (for bugs)
Consider the following JSON body:
```
{
"matching_type": "AND",
"description": "O365 Management API",
"disabled": true,
"title": "Illuminate:O365 Messages",
"content_pack": null,
"remove_matches_from_default_stream": true,
"index_set_id": "9dd48538cfba81c01c216d4d",
"is_default": false
}
```
This is pulled directly from the `/streams` endpoint, which yields:
```
{
"id": "60ca9bf90d73097cdf0e000a",
"creator_user_id": "admin",
"outputs": [],
"matching_type": "AND",
"description": "O365 Management API",
"created_at": "2021-06-17T00:48:57.124Z",
"disabled": true,
"rules": [],
"alert_conditions": [],
"alert_receivers": {
"emails": [],
"users": []
},
"title": "Illuminate:O365 Messages",
"content_pack": null,
"remove_matches_from_default_stream": true,
"index_set_id": "9dd48538cfba81c01c216d4d",
"is_default": false
},
```
Now the schema for creating a stream consists of:
```
{
title (string, optional),
description (string, optional),
rules (array[object], optional),
content_pack (string, optional),
matching_type (string, optional) = ['AND' or 'OR'],
remove_matches_from_default_stream (boolean, optional),
index_set_id (string, optional)
}
```
Which omits a large number of the attributes that are returned via the API. Where this is problematic is when attempting to use any of these attributes not showing up as part of the schema, an error is returned:
```
{
"type": "ApiError",
"message": "Unable to map property disabled.\nKnown properties include: index_set_id, rules, title, description, content_pack, matching_type, remove_matches_from_default_stream"
}
```
I would expect that I would be able to use any of the attributes, in particular `"disabled": false` to set a stream to start on creation.
What's unclear to me is the purpose behind creating a disabled stream from the start. While I can see some of the reasoning for not starting it immediately (e.g., I create a stream that I might not be ready to route to), in the case of say, Illuminate content, which has no rules needed to route to the stream (it's all done via pipelines), it's not clear why I wouldn't want to immediately start the stream.
Contributor guide
Assessment
This issue has not been assessed yet.