# Checking condition in a pipeline

**URL:** <https://community.graylog.org/t/checking-condition-in-a-pipeline/4506>\
**Category:** Graylog Central (peer support)\
**Created:** [March 9, 2018, 1:07pm UTC](https://community.graylog.org/t/checking-condition-in-a-pipeline/4506 "2018-03-09T13:07:26Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![Magneton](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/magneton/32/1609_2.png) [@Magneton](https://community.graylog.org/u/Magneton)\
**Post date:** [March 9, 2018, 1:07pm UTC](https://community.graylog.org/t/checking-condition-in-a-pipeline/4506/1 "2018-03-09T13:07:27Z")

</div>

HI All,

I wonder is someone could help me out.

I want to write a pipeline rule checks two conditions and sets a field.

Example

```auto
// function to detect bad things

rule "lets detect bad stuff"
when
   // To save CPU cycles, only run on this field in stream
   
   has_field("sysmon_event_id") AND 
  
   then

	set_field("BadDetected", "true");
	
end

```

The logic in the when condition is something similar to below

If sysmon\_eventid=11 and granted-access=0x100 then set field

Both sysmon\_event\_id and granted access are fields and can be searched on inn the search bar with this

(sysmon\_event\_id:11 AND GrantedAccess:“0x100”)

Does this logic work in functions?

Cheers Jake

---

<div class="post-metadata">

**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\
**Post date:** [March 9, 2018, 1:33pm UTC](https://community.graylog.org/t/checking-condition-in-a-pipeline/4506/2 "2018-03-09T13:33:58Z")

</div>

> [@Magneton](#):
>
> Does this logic work in functions?

Yes, it does. You can use various boolean operators (AND, OR, NOT) to chain conditions in the `when` clause of your rules.

See [http://docs.graylog.org/en/2.4/pages/pipelines/rules.html](http://docs.graylog.org/en/2.4/pages/pipelines/rules.html) for details.

---

<div class="post-metadata">

**Author:** ![Magneton](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/magneton/32/1609_2.png) [@Magneton](https://community.graylog.org/u/Magneton)\
**Post date:** [March 9, 2018, 1:51pm UTC](https://community.graylog.org/t/checking-condition-in-a-pipeline/4506/3 "2018-03-09T13:51:07Z")

</div>

Hi Jochen,

So something like this.

```auto
// function to detect bad things

rule "lets detect bad stuff"
when
      
   // sets check for the presence of both fields
   
   has_field("sysmon_event_id") && has_field("GrantedAccess") 
  
   then
        contains(to_string($message.sysmon_event_id","11") && (to_string($message.GrantedAccess","0x100");
	set_field("BadDetected", "true");
	
end

```

Would this work?

Cheers Jake

---

<div class="post-metadata">

**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\
**Post date:** [March 9, 2018, 1:55pm UTC](https://community.graylog.org/t/checking-condition-in-a-pipeline/4506/4 "2018-03-09T13:55:05Z")

</div>

it should be more like:

```auto
// function to detect bad things

rule “lets detect bad stuff”
when
  // sets check for the presence of both fields
  has_field(“sysmon_event_id”) AND
  has_field(“GrantedAccess”) AND
  contains(to_string($message.sysmon_event_id,“11”) AND
  contains(to_string($message.GrantedAccess,“0x100”)
then
  set_field(“BadDetected”, “true”);
end

```

---

<div class="post-metadata">

**Author:** ![Magneton](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/magneton/32/1609_2.png) [@Magneton](https://community.graylog.org/u/Magneton)\
**Post date:** [March 9, 2018, 2:17pm UTC](https://community.graylog.org/t/checking-condition-in-a-pipeline/4506/5 "2018-03-09T14:17:42Z")

</div>

Hi Jochen,

I get an incompatable types error see

 ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/5/53549151f76fd5e22268503de1d7108e319d94d8.png)

So I tried

 ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/0/0df6b27e7508639dcab238d07e603c6200655b3e.png)

Am i missing a semi colon or something somewhere?

Cheers  
Jake

---

<div class="post-metadata">

**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\
**Post date:** [March 9, 2018, 2:31pm UTC](https://community.graylog.org/t/checking-condition-in-a-pipeline/4506/6 "2018-03-09T14:31:29Z")

</div>

Hej Jake,

actually I just wrote the rule direct in the Forum - not in the editor. That is just missing `)` and wrong `"` and I missed the order of contains (first value then the string)

```auto
rule "lets detect bad stuff"
when
  // sets check for the presence of both fields
  has_field("sysmon_event_id") AND
  has_field("GrantedAccess") AND
  contains("11",to_string($message.sysmon_event_id)) AND
  contains("0x100", to_string($message.GrantedAccess))
then
  set_field("BadDetected", "true");
end

```

---

<div class="post-metadata">

**Author:** ![Magneton](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/magneton/32/1609_2.png) [@Magneton](https://community.graylog.org/u/Magneton)\
**Post date:** [March 9, 2018, 4:17pm UTC](https://community.graylog.org/t/checking-condition-in-a-pipeline/4506/7 "2018-03-09T16:17:20Z")

</div>

Hi Jochen,

Cheers for your help once again, I have Graylog doing something special.

Cheers

Jake

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [March 23, 2018, 4:17pm UTC](https://community.graylog.org/t/checking-condition-in-a-pipeline/4506/8 "2018-03-23T16:17:24Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.