Dynamic extractor

Graylog Central (peer support)
7

Hello,

After looking in the forum I did come across using CSV file for a “Lookup table”, maybe that can be an option.
Other then that pipeline maybe something like this. It may or may not work, I gave it a try :smiley:

rule "Host lap1"
when
    has_field("message") AND contains(to_string($message.message), "lap1:213123123123")
then
    set_field("host1","lap1");
end
rule "Host lap2"
when
    has_field("message") AND contains(to_string($message.message), "lap2:11111111")
then
    set_field("host2","lap2");
end
rule "Host lap3"
when
    has_field("message") AND contains(to_string($message.message), "lap3:12312312322")
then
    set_field("host3","lap3");
end