How do you rename fields?

Hi I am just starting with Graylog, so I am hoping this is something trivial.

I have a message that I am getting via GELF and it stores things correctly and I made it route through a stream. I just want to simply change one field X-Request-ID to requestID. I created a rule

rule "X-Request-ID to requestID"
  has_field("X-Request-ID") // <-- how do I make this any message without is_not_null("FOO")
  rename_field("X-Request-ID", "requestID");

Then I added a pipeline with one stage containing the above rule and attached it to the pipeline I created.

However, when I send messages, I still see it using X-Request-ID

OK got it working thanks to I just had to make sure Message Chain goes before Pipeline Processor. Not sure why the default goes the other way (aside from Alphabetical order)

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.