# Condition in condition in Pipeline

**URL:** <https://community.graylog.org/t/condition-in-condition-in-pipeline/4962>\
**Category:** Graylog Central (peer support)\
**Created:** [April 13, 2018, 9:20am UTC](https://community.graylog.org/t/condition-in-condition-in-pipeline/4962 "2018-04-13T09:20:25Z")\
**Posts on this page:** 17\
**Page:** 1

<div class="post-metadata">

**Author:** ![anthodu57](https://avatars.discourse-cdn.com/v4/letter/a/e36b37/32.png) [@anthodu57](https://community.graylog.org/u/anthodu57)\
**Post date:** [April 13, 2018, 9:20am UTC](https://community.graylog.org/t/condition-in-condition-in-pipeline/4962/1 "2018-04-13T09:20:25Z")

</div>

Hy,  
I wish make this pipeline’s rule:

> rule “IPClass”  
> when  
> has\_field(“IPsource”)  
> then  
> [//xxx.xxx.xxx.xxx](https://xxx.xxx.xxx.xxx)  
> let splitIP=split(“[.]”,to\_string($message.IPsource));  
> let octet1=splitIP[0];  
> let octet2=splitIP[1];  
> let octet3=splitIP[2];  
> let locationSite = “”;
> 
> ```
> when
> octet1 == xxx && octet2 == xxx && octet3 == xxx
> 
> ```
> 
> then  
> locationSite=“Site1”;  
> end
> 
> ```
> set_field("LocationSite",locationSite);
> 
> ```
> 
> end

But, Graylog don’t would like this:  
“extraneous input ‘when’ expecting {‘;’, End, Let, Identifier}”

Best regard,  
Anthony,

---

<div class="post-metadata">

**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\
**Post date:** [April 13, 2018, 9:37am UTC](https://community.graylog.org/t/condition-in-condition-in-pipeline/4962/2 "2018-04-13T09:37:29Z")

</div>

What are you trying to achieve ultimately?

Usually, you would use two rules in consecutive stages for what I think you’re trying to do.

PS: Please format your posts for better readability: [https://help.github.com/articles/creating-and-highlighting-code-blocks/](https://help.github.com/articles/creating-and-highlighting-code-blocks/)

---

<div class="post-metadata">

**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\
**Post date:** [April 13, 2018, 11:02am UTC](https://community.graylog.org/t/condition-in-condition-in-pipeline/4962/3 "2018-04-13T11:02:13Z")

</div>

you can only have one when / then block in each rule - so your rule would need three rules.

---

<div class="post-metadata">

**Author:** ![anthodu57](https://avatars.discourse-cdn.com/v4/letter/a/e36b37/32.png) [@anthodu57](https://community.graylog.org/u/anthodu57)\
**Post date:** [April 13, 2018, 12:13pm UTC](https://community.graylog.org/t/condition-in-condition-in-pipeline/4962/4 "2018-04-13T12:13:56Z")

</div>

I need sort the IP according to their site.  
I doesn’t can use three rules because graylog need a test when I use $ message.IPsource.  
Best regard,  
Anthony,

---

<div class="post-metadata">

**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\
**Post date:** [April 13, 2018, 12:36pm UTC](https://community.graylog.org/t/condition-in-condition-in-pipeline/4962/5 "2018-04-13T12:36:05Z")

</div>

Maybe using `to_ip()` and `cidr_match()` would be simpler?

---

<div class="post-metadata">

**Author:** ![anthodu57](https://avatars.discourse-cdn.com/v4/letter/a/e36b37/32.png) [@anthodu57](https://community.graylog.org/u/anthodu57)\
**Post date:** [April 13, 2018, 12:40pm UTC](https://community.graylog.org/t/condition-in-condition-in-pipeline/4962/6 "2018-04-13T12:40:54Z")

</div>

I don’t know how cidr\_match() work (Checks whether the given ip address object matches the cidr pattern) but it would always require an additional condition.

---

<div class="post-metadata">

**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\
**Post date:** [April 13, 2018, 1:08pm UTC](https://community.graylog.org/t/condition-in-condition-in-pipeline/4962/7 "2018-04-13T13:08:54Z")

</div>

> [@anthodu57](#):
>
> but it would always require an additional condition.

Please elaborate on that.

---

<div class="post-metadata">

**Author:** ![anthodu57](https://avatars.discourse-cdn.com/v4/letter/a/e36b37/32.png) [@anthodu57](https://community.graylog.org/u/anthodu57)\
**Post date:** [April 16, 2018, 6:16am UTC](https://community.graylog.org/t/condition-in-condition-in-pipeline/4962/8 "2018-04-16T06:16:44Z")

</div>

Hi,  
If I use that, I need add a condition for check if my field exist.

Graylog’s error:  
“mismatched input ‘let’ expecting When”

Best regard,

---

<div class="post-metadata">

**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\
**Post date:** [April 16, 2018, 7:29am UTC](https://community.graylog.org/t/condition-in-condition-in-pipeline/4962/9 "2018-04-16T07:29:08Z")

</div>

> [@anthodu57](#):
>
> If I use that, I need add a condition for check if my field exist.

Yes, indeed. That’s how the rules work:  
[http://docs.graylog.org/en/2.4/pages/pipelines/rules.html](http://docs.graylog.org/en/2.4/pages/pipelines/rules.html)

---

<div class="post-metadata">

**Author:** ![anthodu57](https://avatars.discourse-cdn.com/v4/letter/a/e36b37/32.png) [@anthodu57](https://community.graylog.org/u/anthodu57)\
**Post date:** [April 16, 2018, 7:43am UTC](https://community.graylog.org/t/condition-in-condition-in-pipeline/4962/10 "2018-04-16T07:43:43Z")

</div>

So, how to do that?

Best regard,

---

<div class="post-metadata">

**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\
**Post date:** [April 16, 2018, 8:49am UTC](https://community.graylog.org/t/condition-in-condition-in-pipeline/4962/11 "2018-04-16T08:49:00Z")

</div>

> [@anthodu57](#):
>
> So, how to do that?

What exactly do you mean?

---

<div class="post-metadata">

**Author:** ![anthodu57](https://avatars.discourse-cdn.com/v4/letter/a/e36b37/32.png) [@anthodu57](https://community.graylog.org/u/anthodu57)\
**Post date:** [April 16, 2018, 8:56am UTC](https://community.graylog.org/t/condition-in-condition-in-pipeline/4962/12 "2018-04-16T08:56:37Z")

</div>

I would like attribute a IP range to a differents sites in my company.  
Best regard,

---

<div class="post-metadata">

**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\
**Post date:** [April 16, 2018, 9:06am UTC](https://community.graylog.org/t/condition-in-condition-in-pipeline/4962/13 "2018-04-16T09:06:55Z")

</div>

As described before, you can use [`to_ip()`](http://docs.graylog.org/en/2.4/pages/pipelines/functions.html#to-ip) and [`cidr_match()`](http://docs.graylog.org/en/2.4/pages/pipelines/functions.html#cidr-match) to check if an IP address is in a given [CIDR block](https://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing).

```auto
rule "example-rule"
when
  has_field("ip_address") &&
  cidr_match("10.0.0.0/8", to_ip($message.ip_address))
then
  set_field("location_site", "Test Location");
end

```

---

<div class="post-metadata">

**Author:** ![anthodu57](https://avatars.discourse-cdn.com/v4/letter/a/e36b37/32.png) [@anthodu57](https://community.graylog.org/u/anthodu57)\
**Post date:** [April 16, 2018, 12:13pm UTC](https://community.graylog.org/t/condition-in-condition-in-pipeline/4962/14 "2018-04-16T12:13:29Z")

</div>

Thank you!!  
It’s possible use the Lookup table?

Best regard,

---

<div class="post-metadata">

**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\
**Post date:** [April 16, 2018, 12:31pm UTC](https://community.graylog.org/t/condition-in-condition-in-pipeline/4962/15 "2018-04-16T12:31:50Z")

</div>

> [@anthodu57](#):
>
> It’s possible use the Lookup table?

No, that’s not possible if you want to store the CIDR blocks in a lookup source, also see: [Mapping IPs to subnets](https://community.graylog.org/t/mapping-ips-to-subnets/4083)

If the number of IP addresses is fairly limited, you could store them (and not the CIDR notation) in a CSV file and create a lookup table from it.

---

<div class="post-metadata">

**Author:** ![anthodu57](https://avatars.discourse-cdn.com/v4/letter/a/e36b37/32.png) [@anthodu57](https://community.graylog.org/u/anthodu57)\
**Post date:** [April 17, 2018, 7:25am UTC](https://community.graylog.org/t/condition-in-condition-in-pipeline/4962/16 "2018-04-17T07:25:00Z")

</div>

Thank you for the two answers. Finally I use the Lookup table but the other answer it’s good.

Best regard,  
Anthony,

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [May 1, 2018, 7:35am UTC](https://community.graylog.org/t/condition-in-condition-in-pipeline/4962/17 "2018-05-01T07:35:02Z")

</div>

Closed on May 1, 2018, 7:35am UTC

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.