I have some servers logging a whole lot of stuff, including some FTP information that I extract to one stream in Graylog.
I have some other servers that log a bunch of information that relates to the FTP log, but are not FTP log. I extract those to a stream also.
What I would like to do, is combine the two streams into one, so that I can observe how the FTP servers affect what goes on on the other servers. I cannot simply combine the two into one stream directly because I must have the FTP facility only from the FTP servers and everything from the others.
I have tried creating a third stream with inputs matching ("exactly streams FTP SERVERS" or "exactly streams OTHER SERVERS") but that stream remains empty.