I created a field using pipeline to get the duration data from the message content.
rule "rule_duration" when has_field("message") AND to_long($message.level) == 6 then let result = split(" ",to_string($message.message)); set_field("duration",to_long(result)); end
I want to create a stream to store the messages their duration value is greater than 0. When I configure the stream by pipeline condition, the messages I send are not redirected to the stream.
Can not I use a field, that is created by pipeline, in stream rules? If yes can you recommend any suggestion to me?