stage 0 match either
rule "input message does come with 7 fields";
rule "input message does not come with 7 fields";
rule "input message does come with 7 fields"
when
// There has 7 fields
regex("^([^\\|]*\\|){6}[^\\|]*$",to_string($message.full_message)).matches
then
// target fields initialized
set_field("x_error_found",false);
set_field("x_errors","");
// Get input field values
set_field("x_long_input",split("\\|",to_string($message.full_message),0));
set_field("x_keyword_input",split("\\|",to_string($message.full_message),1));
set_field("x_text",split("\\|",to_string($message.full_message),2));
set_field("x_multi_fields",split("\\|",to_string($message.full_message),3));
set_field("x_date_input",split("\\|",to_string($message.full_message),4));
set_field("x_boolean_input",split("\\|",to_string($message.full_message),5));
set_field("x_ip_input",split("\\|",to_string($message.full_message),6));
end
rule "input message does not come with 7 fields"
when
not has_field("x_error_found")
then
set_field("x_error_found",true);
set_field("x_errors","input message does not come with 7 fields;");
end
Yes. I put the raw message into full_message field along with other static fields added by collector agent.
i modify the pattern accordingly, but the the result message is same: