A question about the CONTAINS pipeline function

Hello everybody,

I would like to know if a field contains a part of another field.

For example :

field1: buddy
field2: buddytwo.lalala

-> In this case, it should match

So I made some test with the contains function :

rule "test"
    contains(to_string($message.field1), to_string($message.field2))
	set_field("tested", true);

But this doesn’t work : every logs match, even those which don’t have the fields field1 and field2

So I’m asking if we can use $message.fieldname for the substring. Maybe this is not possible ?

Thanks for your help !

You have to check if these fields exist first (via has_field()), otherwise the condition will check if the empty string contains the empty string (which is true) for cases in which the message doesn’t contain the field1 or field2 fields.

Exact jochen. It works perfectly now. I should have check this before…

Thanks for your help ! :slight_smile:

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.