# A question about the CONTAINS pipeline function

**URL:** <https://community.graylog.org/t/a-question-about-the-contains-pipeline-function/1155>\
**Category:** Graylog Central (peer support)\
**Created:** [May 15, 2017, 4:22pm UTC](https://community.graylog.org/t/a-question-about-the-contains-pipeline-function/1155 "2017-05-15T16:22:45Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Loompaz](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/loompaz/32/668_2.png) [@Loompaz](https://community.graylog.org/u/Loompaz)\
**Post date:** [May 15, 2017, 4:22pm UTC](https://community.graylog.org/t/a-question-about-the-contains-pipeline-function/1155/1 "2017-05-15T16:22:45Z")

</div>

Hello everybody,

I would like to know if a field contains a part of another field.

For example :

field1: buddy  
field2: buddytwo.lalala

-\> In this case, it should match

So I made some test with the contains function :

```
rule "test"
when
    contains(to_string($message.field1), to_string($message.field2))
then    
	set_field("tested", true);
end;

```

But this doesn’t work : every logs match, even those which don’t have the fields **field1** and **field2** …

So I’m asking if we can use $message.fieldname for the substring. Maybe this is not possible ?

Thanks for your help !

---

<div class="post-metadata">

**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\
**Post date:** [May 16, 2017, 7:25am UTC](https://community.graylog.org/t/a-question-about-the-contains-pipeline-function/1155/2 "2017-05-16T07:25:37Z")

</div>

You have to check if these fields exist first (via [`has_field()`](http://docs.graylog.org/en/2.2/pages/pipelines/functions.html#has-field)), otherwise the condition will check if the empty string contains the empty string (which is true) for cases in which the message doesn’t contain the `field1` or `field2` fields.

---

<div class="post-metadata">

**Author:** ![Loompaz](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/loompaz/32/668_2.png) [@Loompaz](https://community.graylog.org/u/Loompaz)\
**Post date:** [May 16, 2017, 8:22am UTC](https://community.graylog.org/t/a-question-about-the-contains-pipeline-function/1155/3 "2017-05-16T08:22:51Z")

</div>

Exact jochen. It works perfectly now. I should have check this before…

Thanks for your help ! 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [May 30, 2017, 8:27am UTC](https://community.graylog.org/t/a-question-about-the-contains-pipeline-function/1155/4 "2017-05-30T08:27:06Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.