Help with simple pipeline rule

Graylog Central (peer support)
1

I’m having trouble with a seemingly simple pipeline rule. I’m wondering if anyone could take a look at it and tell me if I’m missing something. Here’s the rule:

rule "rtl type OTHER"
when
  NOT has_field("type")
then
  set_field("type", "OTHER");
end

The intent of the rule is to set the field ‘type’ to the string “OTHER” if the field ‘type’ doesn’t exist. I have two other rules that are working fine that set the ‘type’ field based on the existence of other fields. This is the only one doing so based on NOT having a field.

I have 2 rules in “Stage 0” which both detect the presence of a field and set ‘type’ based on that criteria. Then in Stage 3, I have this rule as a catch all. However, while the first 2 rules are working, this last one never sets the type to “OTHER” as expected.

Any ideas of where I’m going wrong?

2

Stage 3 only run, if one (or all - depend on setting) pipeline rules in Stage 2 match.

3

Thanks @shoothub. Good point, it’s the staging that was incorrect. As you can tell, I’m trying to do an If-Else kind of logic, where if none of the others run, then set type to “OTHER”. I couldn’t figure out a good way to make that specific logic work, so I reordered the rules as follows:

  • Stage 0: if no “type” field, set “type” to “OTHER”
  • Stage 1: If (other specific criteria are met), set “type” to specific known type.

I haven’t been able to give it a try yet, but hopefully this is a good solution. If you have any suggestions on a better way to accomplish this, let me know.

Thanks.

4

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.