Drop message from Pipeline not working

Graylog Central (peer support)
1

Hi,

Am trying to drop a message from a pipeline. According to pipline simulator the message is being caught and should be dropped. However, I still see the message in my search results and see that it is being indexed. Message I want to drop contains text :
“Client 00:17:23:a4:0b:73 may be using an incorrect PSK”

My rule is:

rule “remove WLC Client PSK Spam”
when
has_field (“message”) &&
contains(to_string($message.message), “Client 00:17:23:a4:0b:73 may be using an incorrect PSK”)
then
drop_message();
end

Here is the simulation Screenshot:

GraylogSim
GraylogSim1676×756 48.9 KB

Pipline processing is enabled on my graylog server. Any thing else I should check?

Also, the input that this message comes in on is a udp syslog input. However, in the simulator if I choose the syslog codec, I cannot get a message to load. Not sure if that is part of my problem. What would the correct syntax be in the raw message field of the simulator for a syslog message?

2

I’ve tried your example and everything worked as expected.

If I were you, I would check:

  1. Check that message field certainly contains string you try to search
  2. Check that you use correct stream in Pipeline connection (that contains message you search):
    https://docs.graylog.org/en/3.2/pages/pipelines/stream_connections.html
  3. Pipeline simulator requires full syslog message not only message if you choose syslog message codec, so please add complete syslog message like: <PRI>syslog message
    <165>*Jun 05 14:45:26.511: %DOT1X-3-PSK_CONFIG_ERR: 1x_ptsm.c:516 Client 00:1c:bf:c6:09:a8 may be using an incorrect PSK

https://tools.ietf.org/html/rfc3164#section-4.1.1

3

You should check your messaging processing configuration as well…

You will most likely want your ‘pipeline processing’ to come after the ‘message filter chain’ in the message processing config.

4

Yup, changed the order and all works. it appears that before I could evaulate the message field properly, I had to process it first with message filter chain. Is there any downside to ordering my processing with filters before piplines? I am assuming that the default of Pipeline before filter is for a reason?

5

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.