Graylog2 / Graylog2/graylog2-server

Decouple Outputs from Streams

Open
#6,695 1 comment 0 reactions 0 assignees View on GitHub
feature triaged
Dominant language
Java
Stars
8.1k
Forks
1.1k
Avg merge
1d 20h
Merged PRs (30d)
217

Description

Can we provide a method of sending to an output that does not depend on membership in a stream, or allows for Stream membership without index routing?

## Expected Behavior
A pipeline rule that allows messages to be sent via an Output directly, based on the when conditions. Or a stream definition that allows you to bypass index routing when the original index was not the Default.

## Current Behavior
Currently, if you have two streams (A &B), both going into their own indices, you can not then use a single stream to forward a subset of events from each to an output without ingesting them twice. You cannot remove them from the All Messages stream, since that has been done already. Currently, you have to define a third index and ingest that subset of messages twice.

## Possible Solution
Pipeline rule that sends directly to an output.

## Context
Customer needs to send/output a subset of events to a SIEM. They want to define one stream to do this. Currently, they have to create an "output" stream for each stream they wish to draw from.
## Your Environment

* Graylog Version: 3.x
* Elasticsearch Version: 6.x

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.