# Build Correlation

**URL:** <https://community.graylog.org/t/build-correlation/1293>\
**Category:** Graylog Central (peer support)\
**Created:** [May 31, 2017, 1:50pm UTC](https://community.graylog.org/t/build-correlation/1293 "2017-05-31T13:50:10Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![tharu85](https://avatars.discourse-cdn.com/v4/letter/t/e95f7d/32.png) [@tharu85](https://community.graylog.org/u/tharu85)\
**Post date:** [May 31, 2017, 1:50pm UTC](https://community.graylog.org/t/build-correlation/1293/1 "2017-05-31T13:50:10Z")

</div>

I tried to build a correlation using log sources. As per my requirement I need to filter a source\_ip address from one log source which has been blocked by IPS and I need to checked that blocked source\_ip with another log source, source\_ip whether matching attemps are there ?

source:server\_a AND status:blocked AND srcip: (should match with) source:server\_b AND scrip

Tried several possible logical condition. But unable to create it. Any idea on this are warmly welcome

---

<div class="post-metadata">

**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\
**Post date:** [May 31, 2017, 3:11pm UTC](https://community.graylog.org/t/build-correlation/1293/2 "2017-05-31T15:11:47Z")

</div>

Maybe [this](https://github.com/billmurrin/graylog-plugin-slookup-function) plugin can help you - but with vanilla Graylog that is not possible.

---

<div class="post-metadata">

**Author:** ![tharu85](https://avatars.discourse-cdn.com/v4/letter/t/e95f7d/32.png) [@tharu85](https://community.graylog.org/u/tharu85)\
**Post date:** [May 31, 2017, 6:07pm UTC](https://community.graylog.org/t/build-correlation/1293/3 "2017-05-31T18:07:38Z")

</div>

How to I install given plugin in Graylog ?

---

<div class="post-metadata">

**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\
**Post date:** [June 1, 2017, 7:22am UTC](https://community.graylog.org/t/build-correlation/1293/4 "2017-06-01T07:22:41Z")

</div>

please [read the documentation](http://docs.graylog.org/en/2.2/pages/plugins.html#installing-and-loading-plugins).

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [June 15, 2017, 7:29am UTC](https://community.graylog.org/t/build-correlation/1293/5 "2017-06-15T07:29:46Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.