Graylog2 / Graylog2/graylog2-server
Enhance the way route_to_stream and remove_from_stream behave
- Dominant language
- Java
- Stars
- 8.1k
- Forks
- 1.1k
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 217
Description
## What?
This feature requests humbly asks for some enhancements to the way that both `route_to_stream()` and `remove_from_stream()` in order to make them more intuitive and more user friendly to use
* `route_to_stream()`
* add a flag that allows moving the message instead of copying it, basically doing what `remove_from_default` but for any stream. If you use `route_to_stream()`. If its impossible to introduce this without it being a breaking change, possibly adding a complementary pipeline function that can do this?
* `remove_from_stream()`
* allow this function to work without accepting any arguments. currently, in order to use this function you must explicitly declare the stream you want to remove the message from.
## Why?
The use of `route_to_stream` implies the message is moved from one stream to another, however the behavior is that the message is copied (duplicated). I found this behavior counterintuitive from what i expected to happen. This can also lead to users inadvertently duplicating log messages if they do use `route_to_stream` from a non default stream and don't understand the ramifications of doing so. What they would need to do, assuming they are aware, is to use `remove_from_stream` in conjunction with `route_to_stream`.
Given the above, the behavior of `remove_from_stream` also further complicates this scenario because a user has to track down what the stream id (or now name) and explicitly specify that. My thinking is that the pipeline rule knows what stream it is executing in and can execute without an explicit properly in order to be more user friendly.
## Your Environment
* Graylog Version: 6.0.2
* OpenSearch Version: 2.12.0
* MongoDB Version: 6.0.15
* Operating System: Ubuntu Server 22.04 LTS
* Browser version: Google Chrome Version 125.0.6422.61 (Official Build) (arm64)
Please let me know if there are any questions. Happy to chat further about the use case. Also noting this isn't particularly urgent nor important so no rush on reviewing.
Contributor guide
Assessment
This issue has not been assessed yet.