How to set log attack with severity level?

[senox007 (sansan)]

how to change log level into string severity level like info, low, medium,critical?

[zoulja]

Sounds like work for pipeline.
Please show actual input and expected output

[senox007 (sansan)]

yeah but i don’t now, how to write pipeline for convert

[shoothub]

If it’s standard syslog level, create simple pipeline rule:

rule "convert level to severity"
when
    has_field("level")
then
    set_field("severity",syslog_level($message.level));
end

After that, create new pipeline and attach new rule to stage.

And the best way is to read great graylog manual:
https://docs.graylog.org/en/3.1/pages/pipelines.html

[Karlis]

https://docs.graylog.org/en/3.1/pages/queries.html#syslog-severity-mapper

[senox007 (sansan)]

thank you very much it’s working