Creating new fields in pipeline

Graylog Central (peer support)
,
1

Hi all,

I am currently retrieving data from one stream and displaying it on another using slookup pipeline rule. However the field that are added are only decorators and i need a way to display it on the dashboard, are there any way to add these fields into the message permanently or create a new message using the retrived value?

Thank you.

Pipeline Rule
rule "Enrich Data"
when
    has_field("src_addr")
then
    let system_info = slookup("5cd8eaf2cc57e401e53319a1", "src_addr", "@indicator", ["share_level"], "55000000", "desc");
    set_field("badip_first_seen", to_string(system_info));
    route_to_stream("5ccfe39fcc57e401bf0ddac7");
end
2

use the pipeline in message processing and not only as decorator is the solution.

1 Like
3

If you don’t mind me asking, how do i do that?

4

Moving the message filter chain above pipeline processor does what i want, thank you.

5

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.