Advanced rule modify another message


(Michael) #1

I’m in the need to create a rule that capture timestamp and/or ID from the message & inject them to another old message where a predefined ID is set.

need to get that the problem was solved & what time of resolution.

I managed to do the following rule:

rule "Inject time"
when
has_field(“message”)
then
let FID = $message.FID; ## current message log ID that need to be matched
let old_ID = slookup(“Xsame stream IDX”, “FID”, “$FID”, “$message.id”, “14400”);
let new_time = $message.timestamp;
set_field(“DLR_time”, new_time, old_ID);
end

is that possible to change content of another message as documented on the set_field ??

is there any other ideas to do that ??


(Jochen) #2

That’s not possible. Log messages are considered to be immutable after they’ve been indexed.