Access to previous message in pipeline rule

Graylog Central (peer support)
1

Is there a way to get the previous message values in a pipeline before saving a new message?

This is a pseudocode of what i’m trying to accomplish

rule "concatenate sha512"
when
  has_field("hash")
then
  let previoushash = $PREVIOUSMESSAGE.hash || ''
  let hash = sha512(to_string($message.message) + previoushash);
  set_field("hash", hash);
end

idk, how to get $PREVIOUSMESSAGE, or in general if the pipeline is where is should do this kind of operation…

2

hello,

I don’t think that is possible as messages are passing though the pipelines without references to other messages.

3

just trying to find a way… maybe using a lookup table that read the last inserted value in the graylog index?

4

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.