Graylog2-server: Testing message against default stream returns erroneous information

[edmundoa]

From the search results, it is possible to test a message against the default stream. That renders the edit stream rules page with the selected message, but the result of testing the message against the stream seems to always be negative.

Please also note that the controls to add new stream rules are displayed. I tried adding a rule to the default stream and that returned a 400 response from the server, so it seems that it's only a display issue.

Expected Behaviour

Testing a message against the default stream should return true, or not be allowed at all, as it would always match.

Current Behaviour

Testing a message against the default stream returns false, and it displays controls to add new stream rules.

Steps to Reproduce (for bugs)

1. Go to the search results
2. Expand a message in the results table
3. Select test against stream, and then choose the default stream
4. See that the box down the page is red (as when it fails). Also notice that there are controls to add a new stream rule

Your Environment

• Graylog Version: Graylog 2.2.0-rc.1-SNAPSHOT (0308a94)

[kroepke]

I think we shouldn't even allow testing against the default stream.

The rules when a message is going to be on that stream depends on all the other streams (because a stream can request a message to be taken off the default one).
As you mention, the default stream cannot have any rules (so the UI is wrong here) because it is not actually processed during the stream routing step but instead added manually elsewhere.

I'd vote for removing the default stream from the list of "testable" streams and displaying an error message if the test page is called with the default stream as a target (which then should only happen if someone does this manually via the URL).