Pipelines not working with Raw/Plaintext TCP input

igalvit commented 7 years ago

I'm trying to upload old gzip logs using a Raw/Plaintext TCP input and the rules of the pipeline don't change the messages.

Expected Behavior

When data is received in the Raw/Plaintext TCP input it should pass apply the changes coded in the corresponding rules of the pipelines.

Current Behavior

Not working.

Possible Solution

No idea.

Steps to Reproduce (for bugs)

1.Run Graylog 2.2.3 2.Create Raw/Plaintext TCP Input

Add static field "test". 4.Create Pipeline with a rule that adds a new field (for example) when the message has a "test" field.

Context

Trying to send raw data from bash script to upload old logfiles.

Your Environment

Graylog Version: Graylog 2.2.3+7adc951 on lab-uap-elk2 (Oracle Corporation 1.8.0_131 on Linux 3.10.0-514.21.1.el7.x86_64)
Elasticsearch Version: 2.4.2
MongoDB Version: 3.4.4
Operating System: CentOS 7.3
Browser version: Firefox 54.0

joschi commented 7 years ago

@igalvit Please attach your pipeline rules and extractors, as well as the complete configuration of your Raw/Plaintext TCP input, some sample messages, and a description how you send these messages to Graylog. Thanks!

joschi commented 7 years ago

@igalvit Also make sure that the order of message processors is correct: System / Configurations / Message Processors Configuration

The "Pipeline Processor" has to run after the "Message Filter Chain" (which contains the message filter for adding static fields), if you want to access the static fields.

igalvit commented 7 years ago

@joschi Thanks for your help. That was the problem, I didn't change the message processors configuration.

Graylog2 / graylog2-server