How to exclude log with pipeline?

Graylog Central
#1

Hi everyone,

I would like to add pipeline to exclude automatically some logs ?
I think that I must use pipeline but I don’t know how ! I’m just beginning Graylog :slight_smile:

For example I would like to exclude log with such host or source.

For information I receive all logs with JSON format.

#2

Yes, you can use the processing pipelines for that, see http://docs.graylog.org/en/2.3/pages/pipelines.html for details.

You can stop processing messages with the drop_message() function.

2 Likes
#3

Ok thanks you for your answer but could you give me one example ?
I 'm not a good dev :slight_smile:

I try for drop message :
rule "drop cronjob"
when
has_field(“application_name”) && to_string($message.application_name) == "CRON"
then
drop_message();
end

Is it correct for you ?

#4

@Groucou

that should work

1 Like
#5

Ok thx and for my new pipeline

pipeline "My new pipeline"
stage 1 match all
rule “drop message”;
end

#6

Looks fine.

Why don’t you just try it out instead of asking if it’s fine?

#7

Now yes :slight_smile:

#8

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.