Can pipelines be used to redurce incomming traffic?

[gsmith]

Hey,

@oebhardt

So, just to clarify: if I drop traffic at a pipeline, it is not counted into the outgoing traffic used for licensing?

I believe this would depend on where the pipeline is placed ( i.e., stage). so long as it doesnt hit Elasticsearch you should be good. TBH @tmacgbay probable would know better then I on these configrations and what to do.

Example:

rule “Drop Syslog Messages”
when
   has_field("level") AND  ( to_string($message.level) == “7” OR  lowercase(to_string($message.level)) == "debug" )
then
   drop_message();
end

Or something like this.

Pipeline Rule - Drop messages with field containing IP

you can use the debug() function and watch what it’s output is in the Graylog logs: tail -f /var/log/graylog-server/server.log rule "Drop NAT from specific Subnet" when starts_with(to_string($message.Int_Src_IP), "172.16.40") then debug("Source IP match:"); debug(to_string($message.Int_Src_IP)); drop_message(); end if nothing shows you can change the when to has_field("Int_Src_IP") just to make sure you get to the debug Debug Function - Graylog 4.0

Log shippers, there are setting/s to prevent specific logs from being shipped.
With Firewall’s/ Routers/Switchs/ AP’s, etc… most if not all have setting to minumize the amount of logs being sent.

A good example would be Cisco switch.

sw#enable
sw#configure terminal
sw#logging enable
sw#logging Graylog-Server
sw#logging trap level
	emergencies
	alerts
	critical
	errors
	warnings
	notifications
	informational (default level)
	debugging
#end