Hi.
Graylog 3.0.2+1686930
I’m trying to parse json fields in pipeline rule. In stage 0 I’m parsing “message” field, creating “Properties” field from it and parsing “Properties”:
when
has_field("Properties") &&
contains(to_string($message.message), "data", true)
then
let msg = parse_json(to_string($message.message));
let prop = select_jsonpath(msg, {Properties: "$.Properties"});
set_field("Properties", to_string(prop.Properties));
let props = parse_json(to_string($message.Properties));
set_fields(to_map(props));
end
This part is working fine.
As result, new “IntegrationEvent” field appears.
In stage 1 I’m parsing json from “IntegrationEvent”. Simple script, like
let ints = parse_json(to_string($message.IntegrationEvent));
set_fields(to_map(ints));
does not work: nothing happens there, new fields does not appear.
I was trying to write this script:
when
has_field("Properties") &&
contains(to_string($message.Properties), "IntegrationEvent", true)
then
let prop = parse_json(to_string($message.Properties));
let int = select_jsonpath(prop, {IntegrationEvent: "$.IntegrationEvent"});
let ints = parse_json(to_string(int.IntegrationEvent));
set_fields(to_map(ints));
end
I’m checking for “Properties” field instead of “IntegrationEvent”, because didn’t see any result when was checking this field.
I was trying to set_field(“IntegrationEvent2”, to_string(int.IntegrationEvent)), and this field successfully appeared, so the first part of this script is working.
But the second part does not work: Messages, containing “IntegrationEvent” field, disappear.
