Hy,
I wish make this pipeline’s rule:
rule “IPClass”
when
has_field(“IPsource”)
then
//xxx.xxx.xxx.xxx
let splitIP=split("[.]",to_string($message.IPsource));
let octet1=splitIP[0];
let octet2=splitIP[1];
let octet3=splitIP[2];
let locationSite = “”;when octet1 == xxx && octet2 == xxx && octet3 == xxx
then
locationSite=“Site1”;
endset_field("LocationSite",locationSite);
end
But, Graylog don’t would like this:
“extraneous input ‘when’ expecting {’;’, End, Let, Identifier}”
Best regard,
Anthony,