Access to previous message in pipeline rule

Is there a way to get the previous message values in a pipeline before saving a new message?

This is a pseudocode of what i’m trying to accomplish

rule "concatenate sha512"
  let previoushash = $PREVIOUSMESSAGE.hash || ''
  let hash = sha512(to_string($message.message) + previoushash);
  set_field("hash", hash);

idk, how to get $PREVIOUSMESSAGE, or in general if the pipeline is where is should do this kind of operation…


I don’t think that is possible as messages are passing though the pipelines without references to other messages.

just trying to find a way… maybe using a lookup table that read the last inserted value in the graylog index?

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.