# Functions not working

**URL:** <https://community.graylog.org/t/functions-not-working/4626>\
**Category:** Graylog Central (peer support)\
**Tags:** pipeline-rules, debuggingpl\
**Created:** [March 19, 2018, 10:47am UTC](https://community.graylog.org/t/functions-not-working/4626 "2018-03-19T10:47:50Z")\
**Posts on this page:** 1\
**Showing post:** 25

<div class="post-metadata">

**Author:** ![Magneton](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/magneton/32/1609_2.png) [@Magneton](https://community.graylog.org/u/Magneton)\
**Post date:** [March 20, 2018, 3:21pm UTC](https://community.graylog.org/t/functions-not-working/4626/25 "2018-03-20T15:21:09Z")

</div>

Hi Jochen,

The documentation says the following

contains(value: string, search: string, [ignore\_case: boolean])

Checks if value contains search, optionally ignoring the case of the search pattern.

So this would mean a contains statement should be

contains(to\_string($message.sysmon\_cmd\_parent\_file,“EXCEL.EXE”))

This would search for the “EXCEL.EXE” within the string of the field message.sysmon\_cmd\_parent\_file ie “C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE” with the option to ignore case

This makes sense, however it is in oppostion to my earlier conversation with Jan here at [Checking condition in a pipeline](https://community.graylog.org/t/checking-condition-in-a-pipeline/4506/6)

 ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/8/826bda13a7a29e544fefaa9a34b63fa5acd6ff1a.png)

I think I have figured it out.

In the example above the strings are searching for identical matches as the fields can only contain “11” for sysmon\_event\_id so the order does not matter, where as in my example I am looking for a partial match so it matters?

Cheers

Jake

---

_[View the full topic](https://community.graylog.org/t/functions-not-working/4626)._