# Exempting certain I.P Addresses Using Pipelines

**URL:** <https://community.graylog.org/t/exempting-certain-i-p-addresses-using-pipelines/3394>\
**Category:** Graylog Central (peer support)\
**Created:** [December 5, 2017, 3:32pm UTC](https://community.graylog.org/t/exempting-certain-i-p-addresses-using-pipelines/3394 "2017-12-05T15:32:35Z")\
**Posts on this page:** 14\
**Page:** 1

<div class="post-metadata">

**Author:** ![haywhai](https://avatars.discourse-cdn.com/v4/letter/h/bbe5ce/32.png) [@haywhai](https://community.graylog.org/u/haywhai)\
**Post date:** [December 5, 2017, 3:32pm UTC](https://community.graylog.org/t/exempting-certain-i-p-addresses-using-pipelines/3394/1 "2017-12-05T15:32:35Z")

</div>

Hi guys, please what’s the exact syntax if i want to remove a certain i.p address using pipelines.

e.g

when  
src\_ip != 10.10.10.255  
then  
set\_field ();  
end

---

<div class="post-metadata">

**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\
**Post date:** [December 5, 2017, 4:19pm UTC](https://community.graylog.org/t/exempting-certain-i-p-addresses-using-pipelines/3394/2 "2017-12-05T16:19:36Z")

</div>

You can access message fields (e. g. “src\_ip”) with `$message.src_ip` and drop messages with [`drop_message()`](http://docs.graylog.org/en/2.3/pages/pipelines/functions.html#drop-message).

---

<div class="post-metadata">

**Author:** ![haywhai](https://avatars.discourse-cdn.com/v4/letter/h/bbe5ce/32.png) [@haywhai](https://community.graylog.org/u/haywhai)\
**Post date:** [December 5, 2017, 4:23pm UTC](https://community.graylog.org/t/exempting-certain-i-p-addresses-using-pipelines/3394/3 "2017-12-05T16:23:26Z")

</div>

Can u help combine both $message.src\_ip and drop\_message() under a “when” condition?

Thanks

---

<div class="post-metadata">

**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\
**Post date:** [December 5, 2017, 4:40pm UTC](https://community.graylog.org/t/exempting-certain-i-p-addresses-using-pipelines/3394/4 "2017-12-05T16:40:58Z")

</div>

You can find some examples at [http://docs.graylog.org/en/2.3/pages/pipelines/rules.html#rule-structure](http://docs.graylog.org/en/2.3/pages/pipelines/rules.html#rule-structure)

Do you have a specific problem with creating the rule?

---

<div class="post-metadata">

**Author:** ![haywhai](https://avatars.discourse-cdn.com/v4/letter/h/bbe5ce/32.png) [@haywhai](https://community.graylog.org/u/haywhai)\
**Post date:** [December 5, 2017, 4:45pm UTC](https://community.graylog.org/t/exempting-certain-i-p-addresses-using-pipelines/3394/5 "2017-12-05T16:45:42Z")

</div>

i have used the $message.src\_ip in many pipeline rules and it worked fine…just need the syntax for combining both $message.src\_ip and drop\_message() to exclude a particular source i.p address.

---

<div class="post-metadata">

**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\
**Post date:** [December 5, 2017, 5:06pm UTC](https://community.graylog.org/t/exempting-certain-i-p-addresses-using-pipelines/3394/6 "2017-12-05T17:06:09Z")

</div>

You would check the “src\_ip” field in the `when` block and drop the message in the `then` block.

---

<div class="post-metadata">

**Author:** ![haywhai](https://avatars.discourse-cdn.com/v4/letter/h/bbe5ce/32.png) [@haywhai](https://community.graylog.org/u/haywhai)\
**Post date:** [December 5, 2017, 5:31pm UTC](https://community.graylog.org/t/exempting-certain-i-p-addresses-using-pipelines/3394/7 "2017-12-05T17:31:53Z")

</div>

Okay Okay, something like this:

rule "use"  
when  
has\_field(“src\_ip”)

then  
drop\_message(“10.10.10.255”)  
setfield()  
end

---

<div class="post-metadata">

**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\
**Post date:** [December 6, 2017, 7:27am UTC](https://community.graylog.org/t/exempting-certain-i-p-addresses-using-pipelines/3394/8 "2017-12-06T07:27:29Z")

</div>

more like

```auto
rule "use"
when
  has_field("src_ip") AND $message.src_ip == "10.10.10.255"
then
  drop_message()
end

```

---

<div class="post-metadata">

**Author:** ![haywhai](https://avatars.discourse-cdn.com/v4/letter/h/bbe5ce/32.png) [@haywhai](https://community.graylog.org/u/haywhai)\
**Post date:** [December 7, 2017, 9:04am UTC](https://community.graylog.org/t/exempting-certain-i-p-addresses-using-pipelines/3394/9 "2017-12-07T09:04:58Z")

</div>

> [@jan](#):
>
> rule “use”  
> when  
> has\_field(“src\_ip”) AND $message.src\_ip == “10.10.10.255”  
> then  
> drop\_message()  
> end

Thanks J, It worked. I appreciate

---

<div class="post-metadata">

**Author:** ![haywhai](https://avatars.discourse-cdn.com/v4/letter/h/bbe5ce/32.png) [@haywhai](https://community.graylog.org/u/haywhai)\
**Post date:** [December 7, 2017, 9:28am UTC](https://community.graylog.org/t/exempting-certain-i-p-addresses-using-pipelines/3394/10 "2017-12-07T09:28:06Z")

</div>

```auto
rule "Proxy Top Users and Category"
when
is_not_null("EMAILLOCALPART") && has_field("Proxy_Category")

then
let Name_join = concat(to_string($message.EMAILLOCALPART), " ------> ");
let Name_ID = concat(Name_join,to_string($message.Proxy_Category));

set_field(field:"Proxy_Names", value: Name_ID);
end

```

I still get empty fields appear as some of my email\_users even though i used the “is\_not\_null”. What am I getting wrong please.

Thanks

---

<div class="post-metadata">

**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\
**Post date:** [December 7, 2017, 9:36am UTC](https://community.graylog.org/t/exempting-certain-i-p-addresses-using-pipelines/3394/11 "2017-12-07T09:36:58Z")

</div>

Please consider subscribing to professional support if you require individual and detailed help in your setup.

> **[Enterprise Log Management for Any Scale | Graylog](https://www.graylog.org/products/enterprise)**
>
> Explore data without pre-planning or deep application training. Graylog’s data storage and retrieval architecture allows multi-threaded and distributed search across your environment for faster results.

---

<div class="post-metadata">

**Author:** ![haywhai](https://avatars.discourse-cdn.com/v4/letter/h/bbe5ce/32.png) [@haywhai](https://community.graylog.org/u/haywhai)\
**Post date:** [December 7, 2017, 9:53am UTC](https://community.graylog.org/t/exempting-certain-i-p-addresses-using-pipelines/3394/12 "2017-12-07T09:53:57Z")

</div>

Thanks…i have fixed it already using the rule below:

```auto
rule "Proxy Top Users and Category"
when
is_not_null(message.EMAILLOCALPART) && has_field("Proxy_Category")

then
let Name_join = concat(to_string($message.EMAILLOCALPART), " ------> ");
let Name_ID = concat(Name_join,to_string($message.Proxy_Category)); set_field(field:"Proxy_Names", value: Name_ID);
end

```

---

<div class="post-metadata">

**Author:** ![haywhai](https://avatars.discourse-cdn.com/v4/letter/h/bbe5ce/32.png) [@haywhai](https://community.graylog.org/u/haywhai)\
**Post date:** [December 7, 2017, 11:58am UTC](https://community.graylog.org/t/exempting-certain-i-p-addresses-using-pipelines/3394/13 "2017-12-07T11:58:25Z")

</div>

Good day, pls i need a quick fix on this because it isnt fetching nothing.

```auto
rule "FW_Outbound2"

when
   ( $message.IP == "10.*" OR $message.IP == "172.16.*" OR $message.IP == "172.17.*" OR $message.IP == "172.18.*" OR $message.IP == "172.19.*" OR $message.IP == "172.2O.*" OR $message.IP == "172.21.*"
	OR $message.IP == "172.22.*" OR $message.IP == "172.23.*" OR $message.IP == "172.24.*" OR $message.IP == "172.25.*" OR $message.IP == "172.26.*" OR $message.IP == "172.27.*"
	OR $message.IP == "172.28.*" OR $message.IP == "172.29.*" OR $message.IP == "172.30.*" OR $message.IP == "172.31.*" 
	OR $message.IP == "192.168.*") AND $message.Firewall_DestinationIP != "4.2.2.2" AND $message.Firewall_DestinationIP != "8.8.8.8" AND $message.Firewall_DestinationIP != "255.255.255.255"
	AND $message.Firewall_DestinationIP != "10.10.2.255" 
    
then
    let Name_join = concat(to_string($message.timestamp), " ------> ");
    let Name_ID = concat(Name_join,to_string($message.IP));
    let Name_ID2 = concat(Name_ID, ("---------->"));
    let Name_ID3 = concat(Name_ID2,to_string($message.Firewall_DestinationIP));
    let Name_ID4 = concat(Name_ID3, ("---------->"));
    let Name_ID5 = concat(Name_ID4,to_string($message.dst_port));
    let Name_ID6 = concat(Name_ID5, ("---------->"));
    let Name_ID7 = concat(Name_ID6,to_string($message.categoryOutcome));

set_field(field:"FW_OutboundS", value: Name_ID7);

end

```

Thanks.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [December 21, 2017, 11:58am UTC](https://community.graylog.org/t/exempting-certain-i-p-addresses-using-pipelines/3394/14 "2017-12-21T11:58:37Z")

</div>

Closed on December 21, 2017, 11:58am UTC

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.