Hi there,
i would like to concate two string with a pipeline for a cleaner dashboard but i’m struggeling a little bit.
Here is my code:
rule "concate unlocker"
when
has_field("EventID") AND contains(to_string($message.EventID), "4767")
then
let unlocker = concat(to_string($message.SubjectUserName),to_string(" unlocked "));
let locked_usr = concat(to_string($message.TargetUserName),to_string(" successfully!"));
let unlocker_locked_usr = concat(unlocker,locked_usr);
set_field("unlocker_locked_usr", unlocker_locked_usr);
end
This Rule is connected to a Pipeline as Stage 0 with the Option “All rules on this stage match the message”.
The Pipeline is connected to my Windows Event Stream.
But nothing happens
Thanks!