I would like to know if a field contains a part of another field.
For example :
-> In this case, it should match
So I made some test with the contains function :
rule "test" when contains(to_string($message.field1), to_string($message.field2)) then set_field("tested", true); end;
But this doesn’t work : every logs match, even those which don’t have the fields field1 and field2 …
So I’m asking if we can use $message.fieldname for the substring. Maybe this is not possible ?
Thanks for your help !