# Contains and Drop all other messages

**URL:** <https://community.graylog.org/t/contains-and-drop-all-other-messages/12470>\
**Category:** Graylog Central (peer support)\
**Tags:** pipeline-rules\
**Created:** [October 22, 2019, 11:03am UTC](https://community.graylog.org/t/contains-and-drop-all-other-messages/12470 "2019-10-22T11:03:16Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![markus2066](https://avatars.discourse-cdn.com/v4/letter/m/ba9def/32.png) [@markus2066](https://community.graylog.org/u/markus2066)\
**Post date:** [October 22, 2019, 11:03am UTC](https://community.graylog.org/t/contains-and-drop-all-other-messages/12470/1 "2019-10-22T11:03:16Z")

</div>

Hi All,

I’m looking for a quick pointer (struggling to find an example) of a pipeline rule which will keep any received message which contains the string “NAT Mapping” and drop everything else.

I have used extractors to sort messages (example below) and have the field “msg”

id=firewall sn=C0EAEXXXXXX time=“2019-10-22 11:52:53” fw=XXX.XXX.XXX.X pri=5 c=0 m=1197 msg=“NAT Mapping” n=6546585 src=192.168.XXX.41:44460:X4-V130 dst=XX;XXX:XXX:X:8736:X1 proto=udp/1813 note=“Source: XX:XXX:XXX:XXX, 31733, Destination: XXX:XX:XX:XX, 1813, Protocol: 17” rule=“286 (Managed-\>WAN)” fw\_action=“NA”

Not sure if i’m anywhere near on the right track here but think i want the inverse of the rule below…

rule “Drop NAT Mapping”  
when  
contains(to\_string($message.msg), “NAT Mapping”, true)  
then  
drop\_message();  
end

Any help would be greatly appreciated.

Regards

Mark

---

<div class="post-metadata">

**Author:** ![Ponet](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/ponet/32/2131_2.png) [@Ponet](https://community.graylog.org/u/Ponet)\
**Post date:** [October 22, 2019, 2:44pm UTC](https://community.graylog.org/t/contains-and-drop-all-other-messages/12470/2 "2019-10-22T14:44:50Z")

</div>

Hi Mark,

You can invert your example rule by adding in the ‘NOT’ keyword as shown below:

```auto
rule “Drop non-NAT Mapping”
when
    NOT contains(to_string($message.msg), “NAT Mapping”, true)
then
    drop_message();
end

```

---

<div class="post-metadata">

**Author:** ![markus2066](https://avatars.discourse-cdn.com/v4/letter/m/ba9def/32.png) [@markus2066](https://community.graylog.org/u/markus2066)\
**Post date:** [October 22, 2019, 4:33pm UTC](https://community.graylog.org/t/contains-and-drop-all-other-messages/12470/3 "2019-10-22T16:33:54Z")

</div>

Hi,

I have added the rule as suggested but when i run the simulator anything I input into the “Raw Message” but result in “not stored”.

As far as I can see “msg” is a valid field and shows in “search” with the value of “NAT Mapping” quite often.

Would someone be able to clarify what this part of the rule means “$message.msg” I’m struggling with the syntax and wonder if the rule is looking in the wrong place?

Many thanks

Mark

---

<div class="post-metadata">

**Author:** ![Ponet](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/ponet/32/2131_2.png) [@Ponet](https://community.graylog.org/u/Ponet)\
**Post date:** [October 23, 2019, 7:57am UTC](https://community.graylog.org/t/contains-and-drop-all-other-messages/12470/4 "2019-10-23T07:57:58Z")

</div>

> [@markus2066](#):
>
> Would someone be able to clarify what this part of the rule means “$message.msg” I’m struggling with the syntax and wonder if the rule is looking in the wrong place?

`$message` is the variable which stores the message object, `$message.msg` is the `msg` field of the message.

---

<div class="post-metadata">

**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\
**Post date:** [October 23, 2019, 8:57am UTC](https://community.graylog.org/t/contains-and-drop-all-other-messages/12470/5 "2019-10-23T08:57:25Z")

</div>

what is your processing order in `System > Configuration` ? the way you wanted to have it work the processing pipeline should be below the Message Filter Chain.

---

<div class="post-metadata">

**Author:** ![markus2066](https://avatars.discourse-cdn.com/v4/letter/m/ba9def/32.png) [@markus2066](https://community.graylog.org/u/markus2066)\
**Post date:** [October 28, 2019, 11:03am UTC](https://community.graylog.org/t/contains-and-drop-all-other-messages/12470/6 "2019-10-28T11:03:45Z")

</div>

Hi All,

Apologies for the late response I was caught up on another project last week. Thanks for your responses Ponet and Jan.

So it would appear that my understanding of the $message.msg object/field was correct (thanks).

Also I have changed my processing order but still receive a “not stored” result from the pipeline simulator (output below). Current order is Geoip \> Message chain filter \> Pipeline Processor.

ea25ad41-f96d-11e9-9aff-000c29f6e1c5 Not stored  
Timestamp  
2019-10-28 10:30:08.660  
Stored in index  
Message is not stored

message

id=firewall sn=C0EAE49BB3DE time=“2019-10-22 16:20:59” fw=X.X.X.X pri=5 c=0 m=1197 msg=“NAT Mapping” n=6628269 src=X.X.X.X:46059:X4-V110 dst=X.X.X.X:1813:X1 proto=udp/1813 note=“Source: X.X.X.X, 7938, Destination: X.X.X.X, 1813, Protocol: 17” rule=“286 (EC\_Managed\_Zone-\>WAN)” fw\_action=“NA”

My pipeline rule is as follows:

rule “Drop all but Rule”  
when  
NOT contains(to\_string($message.msg), “NAT Mapping”, false)  
then  
drop\_message();  
end

This is the only pipeline/rule I have so don’t nothing else should be impacting the result. As is often the case with issues such as this i’m sure its something silly resulting my a lack of knowledge/experience with the product. Is there anything glaringly obvious wrong with the above rule?

Many thanks

Mark

---

<div class="post-metadata">

**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\
**Post date:** [October 28, 2019, 2:46pm UTC](https://community.graylog.org/t/contains-and-drop-all-other-messages/12470/7 "2019-10-28T14:46:54Z")

</div>

so the simulator writes that the message is not stored, but actually it is stored?

---

<div class="post-metadata">

**Author:** ![markus2066](https://avatars.discourse-cdn.com/v4/letter/m/ba9def/32.png) [@markus2066](https://community.graylog.org/u/markus2066)\
**Post date:** [October 28, 2019, 3:15pm UTC](https://community.graylog.org/t/contains-and-drop-all-other-messages/12470/8 "2019-10-28T15:15:29Z")

</div>

Sorry, yes that does seem to be the case…I had started using the simulator as a basis to test if the rule was working or not. Looking at the data it seems it started working once I changed the processing order. It would seem what I now need to research is where i am going wrong with the simulator…

Thanks for your suggestions/patience everyone 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [November 11, 2019, 3:15pm UTC](https://community.graylog.org/t/contains-and-drop-all-other-messages/12470/9 "2019-11-11T15:15:32Z")

</div>

Closed on November 11, 2019, 3:15pm UTC

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.