# Drop message from Pipeline not working

**URL:** <https://community.graylog.org/t/drop-message-from-pipeline-not-working/14514>\
**Category:** Graylog Central (peer support)\
**Created:** [March 15, 2020, 9:12pm UTC](https://community.graylog.org/t/drop-message-from-pipeline-not-working/14514 "2020-03-15T21:12:07Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![williamk](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/williamk/32/6014_2.png) [@williamk](https://community.graylog.org/u/williamk)\
**Post date:** [March 15, 2020, 9:12pm UTC](https://community.graylog.org/t/drop-message-from-pipeline-not-working/14514/1 "2020-03-15T21:12:08Z")

</div>

Hi,

Am trying to drop a message from a pipeline. According to pipline simulator the message is being caught and should be dropped. However, I still see the message in my search results and see that it is being indexed. Message I want to drop contains text :  
“Client 00:17:23:a4:0b:73 may be using an incorrect PSK”

My rule is:

rule “remove WLC Client PSK Spam”  
when  
has\_field (“message”) &&  
contains(to\_string($message.message), “Client 00:17:23:a4:0b:73 may be using an incorrect PSK”)  
then  
drop\_message();  
end

Here is the simulation Screenshot:

 ![GraylogSim](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/7/7d37a5f332287d39c25cd5045fec043a3108599a.png)

Pipline processing is enabled on my graylog server. Any thing else I should check?

Also, the input that this message comes in on is a udp syslog input. However, in the simulator if I choose the syslog codec, I cannot get a message to load. Not sure if that is part of my problem. What would the correct syntax be in the raw message field of the simulator for a syslog message?

---

<div class="post-metadata">

**Author:** ![shoothub](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/shoothub/32/6412_2.png) [@shoothub](https://community.graylog.org/u/shoothub)\
**Post date:** [March 16, 2020, 9:27am UTC](https://community.graylog.org/t/drop-message-from-pipeline-not-working/14514/2 "2020-03-16T09:27:00Z")

</div>

I’ve tried your example and everything worked as expected.

If I were you, I would check:

1. Check that message field certainly contains string you try to search
2. Check that you use correct stream in Pipeline connection (that contains message you search):  
[https://docs.graylog.org/en/3.2/pages/pipelines/stream\_connections.html](https://docs.graylog.org/en/3.2/pages/pipelines/stream_connections.html)
3. Pipeline simulator requires full syslog message not only message if you choose syslog message codec, so please add complete syslog message like: `<PRI>syslog message`  
`<165>*Jun 05 14:45:26.511: %DOT1X-3-PSK_CONFIG_ERR: 1x_ptsm.c:516 Client 00:1c:bf:c6:09:a8 may be using an incorrect PSK`

[https://tools.ietf.org/html/rfc3164#section-4.1.1](https://tools.ietf.org/html/rfc3164#section-4.1.1)

---

<div class="post-metadata">

**Author:** ![Ponet](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/ponet/32/2131_2.png) [@Ponet](https://community.graylog.org/u/Ponet)\
**Post date:** [March 16, 2020, 9:38am UTC](https://community.graylog.org/t/drop-message-from-pipeline-not-working/14514/3 "2020-03-16T09:38:47Z")

</div>

You should check your messaging processing configuration as well…

You will most likely want your ‘pipeline processing’ to come after the ‘message filter chain’ in the message processing config.

---

<div class="post-metadata">

**Author:** ![williamk](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/williamk/32/6014_2.png) [@williamk](https://community.graylog.org/u/williamk)\
**Post date:** [March 16, 2020, 9:02pm UTC](https://community.graylog.org/t/drop-message-from-pipeline-not-working/14514/4 "2020-03-16T21:02:03Z")

</div>

Yup, changed the order and all works. it appears that before I could evaulate the message field properly, I had to process it first with message filter chain. Is there any downside to ordering my processing with filters before piplines? I am assuming that the default of Pipeline before filter is for a reason?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [March 30, 2020, 9:02pm UTC](https://community.graylog.org/t/drop-message-from-pipeline-not-working/14514/5 "2020-03-30T21:02:12Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.