A question about the CONTAINS pipeline function

[Loompaz]

Hello everybody,

I would like to know if a field contains a part of another field.

For example :

field1: buddy
field2: buddytwo.lalala

-> In this case, it should match

So I made some test with the contains function :

rule "test"
when
    contains(to_string($message.field1), to_string($message.field2))
then    
	set_field("tested", true);
end;

But this doesn’t work : every logs match, even those which don’t have the fields field1 and field2 …

So I’m asking if we can use $message.fieldname for the substring. Maybe this is not possible ?

Thanks for your help !

[jochen]

You have to check if these fields exist first (via has_field()), otherwise the condition will check if the empty string contains the empty string (which is true) for cases in which the message doesn’t contain the field1 or field2 fields.

[Loompaz]

Exact jochen. It works perfectly now. I should have check this before…

Thanks for your help !