i would like to concate two string with a pipeline for a cleaner dashboard but i’m struggeling a little bit.
Here is my code:
rule "concate unlocker" when has_field("EventID") AND contains(to_string($message.EventID), "4767") then let unlocker = concat(to_string($message.SubjectUserName),to_string(" unlocked ")); let locked_usr = concat(to_string($message.TargetUserName),to_string(" successfully!")); let unlocker_locked_usr = concat(unlocker,locked_usr); set_field("unlocker_locked_usr", unlocker_locked_usr); end
This Rule is connected to a Pipeline as Stage 0 with the Option “All rules on this stage match the message”.
The Pipeline is connected to my Windows Event Stream.
But nothing happens