Messages sent to wrong stream

[moesterheld]

Expected Behavior

Messages should be routed to the stream selected in the input wizard.

Current Behavior

Messages always end up in a seemingly random, but always the same stream.
This might be related to creating multiple streams in one session, I could reproduce it on a 6.2.0-beta.1-1 setup where the first one was routed correctly, following inputs were then always routed to the first one.

Possible Solution

Steps to Reproduce (for bugs)

1. Go to https://smd-open.dev.torch.sh
2. Create a random input
3. Select an existing stream other than "Random Data"
4. Go to input diagnosis
5. Messages seemingly always end up in "Random Data"

Context

Your Environment

• Graylog Version: 6.2.0-beta.1-1
• Java Version:
• OpenSearch Version:
• MongoDB Version:
• Operating System:
• Browser version:

[AntonEbel]

I think the problem here is that the "Random Data" stream had this stream rule:

After deleting the stream rule everything works as expected.

@tellistone can we close this issue or do you think there is something to do here?

[tellistone]

We can close this. It's not the responsibility of the input wizard to make sure the user doesn't (prior or subsequently) create message duplication by adding conflicting stream rules.

[moesterheld]

I didn't check for existing rules, sorry.

I retested it on a fresh installation and thought I ran into the issue again:

• create stream test1
• create input random1 with routing to test1 (remove from default stream)
• messages ended up in default stream

I found out why. It was because I didn't start the stream.

However, after starting the stream, messages were still not removed from the default stream. The rule looks correct and works if the stream is started at creation time.

This seems like a pipeline bug (?), or is this to be expected. Should I create a new issue for this?

[moesterheld]

I tried reproducing the behavior with @AntonEbel but we failed to get into this situation again. Must have been some user error on my side.
No further action required.