How do you rename fields?

Graylog Central (peer support)
,
1

Hi I am just starting with Graylog, so I am hoping this is something trivial.

I have a message that I am getting via GELF and it stores things correctly and I made it route through a stream. I just want to simply change one field X-Request-ID to requestID. I created a rule

rule "X-Request-ID to requestID"
when
  has_field("X-Request-ID") // <-- how do I make this any message without is_not_null("FOO")
then
  rename_field("X-Request-ID", "requestID");
end

Then I added a pipeline with one stage containing the above rule and attached it to the pipeline I created.

However, when I send messages, I still see it using X-Request-ID

2

OK got it working thanks to https://serverfault.com/a/832942/190208 I just had to make sure Message Chain goes before Pipeline Processor. Not sure why the default goes the other way (aside from Alphabetical order)

3

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.