Cardinality on message

Graylog
#1

Hello ,
I have messages like

“trying cardinality:[3,5,7]”
“trying cardinality:[3]”
“trying cardinality:[3,5,7]”
“trying cardinality:[5,7]”
“trying cardinality:[3,5,7]”

these are in the “message” and “fullmessage” .
I’m trying to create an event definition , that catches if cardinality of these messages above are greater than 2. But I see no events generated.

Does cardinality not work on strings ? or if I simply have some number in the message like “trying cardinality:1234” , how do I run the cardinality on the numeric part of the message ?

#2

Hello @kommradHomer, welcome!

You can use an extractor to copy the numeric portion of the message into its own field and then create an event definition against that. Personally I am partial to regex extractors but there are many options available, just be sure to set one up and then apply a numeric transformation to the field once the number is extracted.

#3

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.