# Drop message with rules.drl : Problem **URL:** \ **Category:** Graylog Central (peer support)\ **Tags:** pipeline-rules\ **Created:** [November 30, 2017, 3:39pm UTC](https://community.graylog.org/t/drop-message-with-rules-drl-problem/3343 "2017-11-30T15:39:44Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Groucou](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/groucou/32/2415_2.png) [@Groucou](https://community.graylog.org/u/Groucou)\ **Post date:** [November 30, 2017, 3:39pm UTC](https://community.graylog.org/t/drop-message-with-rules-drl-problem/3343/1 "2017-11-30T15:39:44Z")
Hi, I would like to set up a rule that automatically deletes some messages. For that I enable in server.conf drools rule file. In my file `rules.drl` I put : ```auto import org.graylog2.plugin.Message import java.util.regex.Matcher import java.util.regex.Pattern rule "delete message '/sandbox/files_d/'" when m : Message( getField("message") matches "^sandbox_file_d.*" ) then m.setFilterOut(true); end ``` But when I search this message (sandbox\_file\_d) I always the log 😪 This is an message exemple that I want to drop : ```auto Client_IP 1.1.1.1 Elapsed_ms 0 Host firewall-server Short_message GET /sandbox/files_d/ENT-MARNE_d/sandbox_file_d/:ENT-TEST:hosted-content::logon_TEST_v1.css_1476697711079_17_92748_1 HTTP/1.1 UserAgent Mozilla/5.0 (Linux; Android 5.0.2; SM-T550 Build/LRX22G) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.84 Safari/537.36 VS_Name /ENT-TEST/VS-ENTTEST facility FW_access_log httpStatus 200 OK level -1 message {"facility":"FW_access_log","Host":"firewall-server", "Short_message":"GET /sandbox/files_d/ENT-TEST_d/sandbox_file_d/:ENT-TEST:hosted-content::logon_TEST_v1.css_1476697711079_17_92748_1 HTTP/1.1", "httpStatus":"200 OK", "UserAgent":"Mozilla/5.0 (Linux; Android 5.0.2; SM-T550 Build/LRX22G) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.84 Safari/537.36", "Client_IP":"1.1.1.1", "User":"", "respBytes":"2600", "Elapsed_ms":"0", "VS_Name":"/ENT-TEST/VS-ENTTEST", "Pool_Name":"", "Server_IP":"" } respBytes 2600 source 192.168.253.2 timestamp 2017-11-30T15:30:24.738Z ``` ---
**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\ **Post date:** [November 30, 2017, 4:09pm UTC](https://community.graylog.org/t/drop-message-with-rules-drl-problem/3343/2 "2017-11-30T16:09:21Z")
There was a similar question recently in the GitHub issues: > > > Hello. > > I've tried to blacklist messages that come from syslog to input SYSLOG…-TCP and contain "DHCP". > > Here's input > !\[02\_graylog\_syslog\_tcp\_input\](https://user-images.githubusercontent.com/28108696/33219641-199f0d92-d14c-11e7-94c4-97c6e0ee59dd.png) > > Here's one of such messages > !\[01-dhcp\_graylog\](https://user-images.githubusercontent.com/28108696/33219606-e958777c-d14b-11e7-9a6f-7b3dfd5b9168.png) > > Here's the rule > > import org.graylog2.plugin.Message > import java.util.regex.Matcher > import java.util.regex.Pattern > > rule "Drop DHCP" > when > m : Message( message matches "^DHCP.\*(.|\\n|\\r)\*" ) > then > System.out.println("DEBUG: Blacklisting DHCP message."); > m.setFilterOut(true); > end > > service graylog restart > > 2017-11-24T18:18:05.339+02:00 INFO \[RulesEngineProvider\] Using rules: /etc/graylog/server/rules.drl > > I've tried both variants - "^DHCP.\*" and "^DHCP.\*(.|\\n|\\r)\*" and new messages arrived to graylog and were not filtered out. > > > Graylog v2.3.2+3df951e > Ubuntu 14.04.5 LTS > Linux grayloguser 4.4.0-96-generic x86\_64 > ava(TM) SE Runtime Environment (build 1.8.0\_151-b12) Also, I want to remind everyone of this: > [@Rewritng message with Drools](https://community.graylog.org/t/rewritng-message-with-drools/916/2): > > I would recommend using processing pipeline rules to remove messages: [http://docs.graylog.org/en/2.2/pages/pipelines.html](http://docs.graylog.org/en/2.2/pages/pipelines.html) Support for Drools will be deprecated sooner or later in favor of the processing pipeline. ---
**Author:** ![Groucou](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/groucou/32/2415_2.png) [@Groucou](https://community.graylog.org/u/Groucou)\ **Post date:** [December 1, 2017, 9:14am UTC](https://community.graylog.org/t/drop-message-with-rules-drl-problem/3343/3 "2017-12-01T09:14:28Z")
Ok thanks for your answer 🙂 I succeeded add a pipelinbe and rule for drop message when the filed “Host” is equal to “firewall”. But I would like to add another rule for drop all messages that contain the worl jpg, png and gif in “Short\_message” field. rule "drop jpg" when has\_field(“Short\_message”) && to\_string($message.Short\_message) == "^jpg.\*" then drop\_message(); end But it doesn’t work ☹ ---
**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\ **Post date:** [December 1, 2017, 10:03am UTC](https://community.graylog.org/t/drop-message-with-rules-drl-problem/3343/4 "2017-12-01T10:03:05Z")
Does the “Short\_message” field exist? ---
**Author:** ![Groucou](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/groucou/32/2415_2.png) [@Groucou](https://community.graylog.org/u/Groucou)\ **Post date:** [December 1, 2017, 10:24am UTC](https://community.graylog.org/t/drop-message-with-rules-drl-problem/3343/5 "2017-12-01T10:24:35Z")
Yes of course. I find solution 🙂 rule "drop f5-server" when has\_field(“Host”) && to\_string($message.Host) == "f5-server" then drop\_message(); end ---
**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\ **Post date:** [December 15, 2017, 10:24am UTC](https://community.graylog.org/t/drop-message-with-rules-drl-problem/3343/6 "2017-12-15T10:24:36Z")
Closed on December 15, 2017, 10:24am UTC This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.