Graylog2 / Graylog2/graylog2-server
Streams: Testing against message matches rule "must match exactly 1" works, but in stream has to be "1.0"
- Dominant language
- Java
- Stars
- 8.1k
- Forks
- 1.1k
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 217
Description
### Problem description
We have messages with a field "exit_code" that can be "1" or "0".
We query it like this: "component:A AND exit_code:1" and that works without issues.
When we created a stream to find messages where `exit_code` is 1, we did so by creating the rule:
```
exit_code must match exactly 1
```
and tested this against a message from our indices. That showed "This message would be routed to this stream." but when observed, the messages that arrived after the stream was started weren't routed into the stream.
However, when I inspected the field value, it turned out to be "1.0" and using the adapted rule that matched against that, it worked.
This seems to be more a problem of how the message test feature works than the actual stream matching, but it was pretty frustrating to figure this out.
### Steps to reproduce the problem
1. Create Stream
2. Add rule that matches a field that is a float internally against an integer
3. Test message against this stream rule - Test suceeds
4. Start stream
5. Observe stream, not seeing messages being routed correctly
### Environment
- Graylog Version: 1.3.3 (0fda9dc) (Hansa)
- Elasticsearch Version: 1.7.5
- MongoDB Version: 3.0.9
- Operating System: Ubuntu 14.04 Kernel Version 3.13.0-74
Contributor guide
Assessment
This issue has not been assessed yet.