Match a value within a lookup table


I’m making my way into pipeline rules and graylog features.
I want to know if it’s possible to put a list of servers into a lookup table and then match one of this value into my pipeline rule.

For a single server i have this rule that works as it should :

Rule “Name of my rule”
to_string($message.source) == “A SERVER”
route_to_stream(id: “ID of my stream”);

What i want is to get not one but multiple choices that the source of my message could match.
How should i process ?


Create CSV file for lookup table (lookup table “server” in this example), with content e.g:

"server1","server 1 stream"
"server2","server 2 stream"

And use pipeline rule to route to stream based on CSV file

rule "Route to stream from csv"
    is_not_null(lookup_value("servers", to_string($message.source)))
    let output_stream = lookup_value("server", to_string($message.source));
    // let debug_message = concat("Stream: ", to_string(output_stream));
    // debug(debug_message);
   route_to_stream(name: to_string(output_stream));

Thank you for your answer it works great ! :slight_smile:

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.