Condition in condition in Pipeline

Graylog Central (peer support)
1

Hy,
I wish make this pipeline’s rule:

rule “IPClass”
when
has_field(“IPsource”)
then
//xxx.xxx.xxx.xxx
let splitIP=split(“[.]”,to_string($message.IPsource));
let octet1=splitIP[0];
let octet2=splitIP[1];
let octet3=splitIP[2];
let locationSite = “”;

when
  octet1 == xxx && octet2 == xxx && octet3 == xxx

then
locationSite=“Site1”;
end

set_field("LocationSite",locationSite);

end

But, Graylog don’t would like this:
“extraneous input ‘when’ expecting {‘;’, End, Let, Identifier}”

Best regard,
Anthony,

2

What are you trying to achieve ultimately?

Usually, you would use two rules in consecutive stages for what I think you’re trying to do.

PS: Please format your posts for better readability: https://help.github.com/articles/creating-and-highlighting-code-blocks/

3

you can only have one when / then block in each rule - so your rule would need three rules.

4

I need sort the IP according to their site.
I doesn’t can use three rules because graylog need a test when I use $ message.IPsource.
Best regard,
Anthony,

5

Maybe using to_ip() and cidr_match() would be simpler?

6

I don’t know how cidr_match() work (Checks whether the given ip address object matches the cidr pattern) but it would always require an additional condition.

7

Please elaborate on that.

8

Hi,
If I use that, I need add a condition for check if my field exist.

Graylog’s error:
“mismatched input ‘let’ expecting When”

Best regard,

9

Yes, indeed. That’s how the rules work:
http://docs.graylog.org/en/2.4/pages/pipelines/rules.html

10

So, how to do that?

Best regard,

11

What exactly do you mean?

12

I would like attribute a IP range to a differents sites in my company.
Best regard,

13

As described before, you can use to_ip() and cidr_match() to check if an IP address is in a given CIDR block.

rule "example-rule"
when
  has_field("ip_address") &&
  cidr_match("10.0.0.0/8", to_ip($message.ip_address))
then
  set_field("location_site", "Test Location");
end
1 Like
14

Thank you!!
It’s possible use the Lookup table?

Best regard,

15

No, that’s not possible if you want to store the CIDR blocks in a lookup source, also see: Mapping IPs to subnets

If the number of IP addresses is fairly limited, you could store them (and not the CIDR notation) in a CSV file and create a lookup table from it.

16

Thank you for the two answers. Finally I use the Lookup table but the other answer it’s good.

Best regard,
Anthony,

17

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.