Hi I am just starting with Graylog, so I am hoping this is something trivial.
I have a message that I am getting via GELF and it stores things correctly and I made it route through a stream. I just want to simply change one field
requestID. I created a rule
rule "X-Request-ID to requestID" when has_field("X-Request-ID") // <-- how do I make this any message without is_not_null("FOO") then rename_field("X-Request-ID", "requestID"); end
Then I added a pipeline with one stage containing the above rule and attached it to the pipeline I created.
However, when I send messages, I still see it using X-Request-ID