Graylog2 / Graylog2/graylog2-server
Content Pack - Streams and providing index_set_id
- Dominant language
- Java
- Stars
- 8.1k
- Forks
- 1.1k
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 217
Description
Is there a way to create stream via content-pack connected to given index_set?
## Expected Behavior
I would like to be able to create stream via content-pack and stream should be connected with provided index_set_id (other than the default).
## Current Behavior
Currently providing such stream definition in content-pack:
```
{
"v": "1",
"type": {
"name": "stream",
"version": "1"
},
"id": "959f8538-b5c1-41f7-9615-8d200637a571",
"data": {
"alarm_callbacks": [],
"outputs": [],
"remove_matches": {
"@type": "boolean",
"@value": false
},
"title": {
"@type": "string",
"@value": "HTTP 500"
},
"stream_rules": [
{
"type": {
"@type": "string",
"@value": "REGEX"
},
"field": {
"@type": "string",
"@value": "message"
},
"value": {
"@type": "string",
"@value": "(post|get|delete|put) (.+) (.{2}31m)?500(.{2}0m)? \\([^()]+\\)$"
},
"inverted": {
"@type": "boolean",
"@value": false
}
},
{
"type": {
"@type": "string",
"@value": "CONTAINS"
},
"field": {
"@type": "string",
"@value": "message"
},
"value": {
"@type": "string",
"@value": "HTTP/1.1\" 500 "
},
"inverted": {
"@type": "boolean",
"@value": false
},
"description": {
"@type": "string",
"@value": "backend"
}
},
{
"type": {
"@type": "string",
"@value": "CONTAINS"
},
"field": {
"@type": "string",
"@value": "message"
},
"value": {
"@type": "string",
"@value": "[31m500"
},
"inverted": {
"@type": "boolean",
"@value": false
},
"description": {
"@type": "string",
"@value": ""
}
},
{
"type": {
"@type": "string",
"@value": "REGEX"
},
"field": {
"@type": "string",
"@value": "message"
},
"inverted": {
"@type": "boolean",
"@value": false
}
},
{
"type": {
"@type": "string",
"@value": "CONTAINS"
},
"field": {
"@type": "string",
"@value": "message"
},
"value": {
"@type": "string",
"@value": "status=500"
},
"inverted": {
"@type": "boolean",
"@value": false
},
"description": {
"@type": "string",
"@value": ""
}
}
],
"alert_conditions": [],
"matching_type": {
"@type": "string",
"@value": "OR"
},
"disabled": {
"@type": "boolean",
"@value": false
},
"description": {
"@type": "string",
"@value": "Requests returned 5xx status code"
},
"default_stream": {
"@type": "boolean",
"@value": false
},
"index_set_id": {
"@type": "string",
"@value": "SOME_ID"
},
"constraints": [
{
"type": "server-version",
"version": ">=3.1.3+cda805f"
}
]
},
```
ends up with such error:
```
Caused by: com.fasterxml.jackson.databind.exc.UnrecognizedPropertyException: Unrecognized field "index_set_id" (class org.graylog2.contentpacks.model.entities.AutoValue_StreamEntity), not marked as ignorable (10 known properties: "alarm_callbacks", "outputs", "title", "alert_conditions", "description", "default_stream", "stream_rules", "disabled", "matching_type", "remove_matches"])
at [Source: UNKNOWN; line: -1, column: -1] (through reference chain: org.graylog2.contentpacks.model.entities.AutoValue_StreamEntity["index_set_id"])
```
## Possible Solution
You can create stream via API call but then you are forced to create notifications and event definitions also via API and I would like to minimize such things.
## Your Environment
* Graylog Version: Graylog 3.3.15+3143df2
* Java Version: 1.8.0_312
* Elasticsearch Version: 6.8
* MongoDB Version:
* Operating System: Linux 5.4.176-91.338.amzn2.x86_64
* Browser version:
Is there any way to create stream via content-pack and assign it to a index set different then the default one?
Contributor guide
Assessment
This issue has not been assessed yet.