Hy, I wish make this pipeline’s rule: rule “IPClass” when has_field(“IPsource”) then //xxx.xxx.xxx.xxx let splitIP=split(“[.]”,to_string($message.IPsource)); let octet1=splitIP[0]; let octet2=splitIP[1]; let octet3=splitIP[2]; let locationSite = “”; when octet1 == xxx && octet2 == xxx…

As described before, you can use to_ip() and cidr_match() to check if an IP address is in a given CIDR block . rule "example-rule" when has_field("ip_address") && cidr_match("10.0.0.0/8", to_ip($message.ip_address)) then set_field("location_site", "Test Location"); end

Condition in condition in Pipeline

Graylog Central (peer support)

system (system) Closed May 1, 2018, 7:35am 17

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.

Topic		Replies	Views
Variables in pipelines Graylog Central (peer support) pipeline-rules	2	1531	July 10, 2020
Pipeline rule - additional test within then clause Graylog Central (peer support) pipeline-rules	1	1425	May 4, 2017
Pipeline rules problem Graylog Central (peer support) pipeline-rules	4	902	March 10, 2022
Checking condition in a pipeline Graylog Central (peer support)	7	7956	March 23, 2018
Another try at pipeline rules Graylog Central (peer support) pipeline-rules , debuggingpl	5	1249	August 2, 2017

Condition in condition in Pipeline

Related topics