{"action":"created","issue":{"url":"https://api.github.com/repos/Graylog2/graylog2-server/issues/3112","repository_url":"https://api.github.com/repos/Graylog2/graylog2-server","labels_url":"https://api.github.com/repos/Graylog2/graylog2-server/issues/3112/labels{/name}","comments_url":"https://api.github.com/repos/Graylog2/graylog2-server/issues/3112/comments","events_url":"https://api.github.com/repos/Graylog2/graylog2-server/issues/3112/events","html_url":"https://github.com/Graylog2/graylog2-server/issues/3112","id":191355181,"number":3112,"title":"Stream rules not working","user":{"login":"libby2cm","id":6451331,"avatar_url":"https://avatars.githubusercontent.com/u/6451331?v=3","gravatar_id":"","url":"https://api.github.com/users/libby2cm","html_url":"https://github.com/libby2cm","followers_url":"https://api.github.com/users/libby2cm/followers","following_url":"https://api.github.com/users/libby2cm/following{/other_user}","gists_url":"https://api.github.com/users/libby2cm/gists{/gist_id}","starred_url":"https://api.github.com/users/libby2cm/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/libby2cm/subscriptions","organizations_url":"https://api.github.com/users/libby2cm/orgs","repos_url":"https://api.github.com/users/libby2cm/repos","events_url":"https://api.github.com/users/libby2cm/events{/privacy}","received_events_url":"https://api.github.com/users/libby2cm/received_events","type":"User","site_admin":false},"labels":[{"id":104208622,"url":"https://api.github.com/repos/Graylog2/graylog2-server/labels/needs-input","name":"needs-input","color":"fbca04","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":4,"created_at":"2016-11-23T18:58:18Z","updated_at":"2016-12-02T10:44:34Z","closed_at":null,"body":"Created a new stream called docker that will take all messages which have the field docker_container present. Currently using logspout with logspout-gelf module to route messages into graylog.\r\n\r\n## Expected Behavior\r\nUsing rule of 'docker_container must be present' should cause messages with that field in it to route into stream.\r\n\r\n## Current Behavior\r\nMessages are not routed into stream... even though using a sample message passes rule validation for the stream.  As a test, if I set it to 'invert', all messages for everything then come into stream.\r\n\r\n## Possible Solution\r\nOnly thing I can surmise is that maybe stream rules don't like having underscores in field names.\r\n\r\n## Steps to Reproduce (for bugs)\r\n1. Create a stream\r\n2. set a stream rule for a contains rule of field presence with presumably an underscore in name.\r\n\r\n## Context\r\nCan route required messages into stream...\r\n\r\n## Your Environment\r\n\r\n* Graylog Version: 2.1.2\r\n* Elasticsearch Version:  2.4.2\r\n* MongoDB Version:  2.6.11\r\n* Operating System:  oel6\r\n* Browser version:  ie11, chrome55\r\n"},"comment":{"url":"https://api.github.com/repos/Graylog2/graylog2-server/issues/comments/264426081","html_url":"https://github.com/Graylog2/graylog2-server/issues/3112#issuecomment-264426081","issue_url":"https://api.github.com/repos/Graylog2/graylog2-server/issues/3112","id":264426081,"user":{"login":"rgroothedde","id":5181329,"avatar_url":"https://avatars.githubusercontent.com/u/5181329?v=3","gravatar_id":"","url":"https://api.github.com/users/rgroothedde","html_url":"https://github.com/rgroothedde","followers_url":"https://api.github.com/users/rgroothedde/followers","following_url":"https://api.github.com/users/rgroothedde/following{/other_user}","gists_url":"https://api.github.com/users/rgroothedde/gists{/gist_id}","starred_url":"https://api.github.com/users/rgroothedde/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rgroothedde/subscriptions","organizations_url":"https://api.github.com/users/rgroothedde/orgs","repos_url":"https://api.github.com/users/rgroothedde/repos","events_url":"https://api.github.com/users/rgroothedde/events{/privacy}","received_events_url":"https://api.github.com/users/rgroothedde/received_events","type":"User","site_admin":false},"created_at":"2016-12-02T10:44:34Z","updated_at":"2016-12-02T10:44:34Z","body":"@kroepke Are you using logspout-gelf ? Actually the fieldname send to graylog is: \"docker.container\" but this is converted by graylog to \"docker_container\". \r\nI think this problem is related to #2939 . "}}
{"actor":{"display_login":"rgroothedde"}}