Create a field which name is the value from another on

(Alain) #1

In the question I told this morning (, I now create two fields : xx_tag and xx_value.

The next step for me is to create for each value of xx_tag a new field who’s name is the value of xx_tag, and whos value is value is the value of xx_value

I tried to use a pipeline and the “set_field” function but it seems that the field name created cannot come from the value of another field.

Does somebody have an idea ?


have you tried to use to_string() function. maybe it doesn’t recognize the current type of field

You can check to following informations

(Alain) #3

I have following rule :

rule “xx rule”
set_field(to_string($message.xx_tag.field), $message.xx_value.field);

The syntax seems to be correct (I can save it) but there is no trace from any created field when I search in Graylog.


did you used the rule what you posted?
the “.filed” part don’t needed.
eg.: to_string($message.source)

(system) #5

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.