Graylog2 / Graylog2/graylog2-server
use AND and OR in the stream rules
Open
feature
triaged
- Dominant language
- Java
- Stars
- 8.1k
- Forks
- 1.1k
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 217
Description
## What?
It is not possible to define a rule like the following in the current stream rules:
```
kubernetes_namespace:me AND
( kubernetes_labels_app:aggregator OR kubernetes_labels_app:content OR kubernetes_labels_app:injector )
```
## Why?
Currently a complex regex rule is needed for that OR you need to switch to the processing pipelines for stream routing.
Contributor guide
Assessment
This issue has not been assessed yet.