Graylog2 / Graylog2/graylog2-server

remove_from_all_streams_but_not(STREAMID) function

Open
#7,624 0 comments 0 reactions 0 assignees View on GitHub
feature triaged
Dominant language
Java
Stars
8.1k
Forks
1.1k
Avg merge
1d 20h
Merged PRs (30d)
217

Description

## What?

I have created a rule that routes matches to a certain stream and then uses the remove_from_default function (see below):

route_to_stream(name: “StreamName”, remove_from_default: true);

I want to also make it so that the rule removes the events from all other streams, but it does not appear to be possible. If there were a way to use a wildcard and contains with the remove_from_stream that would be helpful or have a remove_from_all_streams_but_not(STREAMID) function.

## Why?

Something like this would be helpful to prevent contamination of events we do not want in certain streams.

## Your Environment

* Graylog Version: 3.1.4

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.