Best practice - field mapping

I have a csv file that has descriptions for a field in message. Example messages are

{id_field: cryptic_id1}
{id_field: cryptic_id2}

and the csv file that acts as dictionary:

 cryptic_id1,Readable Description1
 cryptic_id2,Readable Description2

I would like to be able to add the description fields into the message dynamically, so if the cryptic_id is contained in the csv file a translation field would be added to the message.

My first idea was to generate a rule with a script to create a long rule in pipeline with a lot of when conditions and then paste the output in interface.
Unfortunately a rule can only have one ‘when’ conditions and creating a lot of rules would require a lot of clicking.

How would I do it otherwise?

You will be able to use the new lookup tables feature in Graylog 2.3.0 for this:

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.