[STREAM selection] about bonfire HOT 4 CLOSED

Is it possible to make a search in all logs instead of specifying a stream?

from bonfire.

The graylog API takes the stream ID as a parameter, so all searches are always in a single stream. Querying multiple streams and merging the results seems to much logic on the client side. So one solution I see is to create an 'All Messages' stream and search in there.

from bonfire.

Ok.

I was thinking about another solution specifying stream only in research field:

bonfire -h host -u user -p pass -@ "7 days ago" "streams:(stream1_ref OR stream2_ref) AND ip

==> In that case how can I bypass the stream selection field?

Regards.

from bonfire.

I think what @mahrz24 was trying to say is that bonfire, as a client, can only communicate with graylog via the API - and the API always gets a stream ID with any query request you make.

Without investigating this myself in detail, it seems like while you can run the query you describe in the graylog web ui, it is impossible to achieve the same through an API call, at least at the moment (without investing an extensive amount of work into the client to fix the logic and do several requests, which sounds at least hairy).

Closing as will-not-fix

from bonfire.