Mathematical operation in pipeline

Graylog Central (peer support)
1

Hi Team,

I have a field called “size” which is in KB (MB,GB). (ex: 25 KB)
I want to convert KB into bytes.

How do i write the pipeline rule in order to achieve this?

Regards,
Vinay.

2 
rule "arithmetic"
when
  true
then
  let size_kb = to_long($message.size);
  set_field("size_bytes", size_kb * 1024);
end

Also see:

3

@jochen Thanks for your help.

I have another field sizeunit is mapped to values to KB, MB, etc. I want to change the multipler 1024 depending on the value.
I can write multiple rules and add a condition to check the value of sizeunit. But that way, I would need multiple functions for each unit.
Is there a way to achieve this in one rule ?

rule "arithmetic"
when
  true
then
  let size = to_long($message.size);
  let size_unit = to_string($message.sizeunit);
  set_field("size_bytes", size * 1024);
end
4

Yes, that’s correct. You would check the “sizeunit” field in the when clause of the rule and multiply the content of the “size” field accordingly.

Alternatively, you could write a Graylog plugin providing a pipeline function which parses “size” and “sizeunit” and returns the desired value.

5

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.