Drop message with rules.drl : Problem

[jochen]

There was a similar question recently in the GitHub issues:

drools, blacklisting, syslog, DHCP

Also, I want to remind everyone of this:

Rewritng message with Drools

I would recommend using processing pipeline rules to remove messages: http://docs.graylog.org/en/2.2/pages/pipelines.html Support for Drools will be deprecated sooner or later in favor of the processing pipeline.