Graylog2/graylog-plugin-pipeline-processor

Pipeline won't process messages from a stream when they are also going to default stream

jasonkeller opened this issue · 1 comments

Problem description

Pipeline will not process a message from a stream if its also routed to the default stream. Attaching the pipeline to the default stream appears to process messages correctly.

Steps to reproduce the problem

  1. Configure a stream to route messages into the stream; let it also fall into the default stream
  2. Attach a pipeline to the new stream; observe that it does not process any messages

Environment

  • Graylog Version: graylog-server/stable,stable,now 2.2.0-11 all
  • Pipeline Processor plugin version: 2.2
  • Elasticsearch Version: elasticsearch/unknown,now 2.4.4 all
  • MongoDB Version: mongodb/xenial 1:2.6.10-0ubuntu1 amd64
  • Operating System: Ubuntu 16.04 Xenial
  • Browser version: Windows 10 / Chrome 56

Just discovered that the default processor order (GeoIP, Pipeline, Message Filter Chain) is the cause of this. Ideally should it not be MFC > Pipeline > GeoIP? Doing it in this order, everything appears to work just fine.