Multi value field

[benoitp]

Hello,
In my journey to get something working for tagging logs I saw this post from @jan

Tags - Am I missing it?

However Graylog does not support multivalues fields so it’s a bit tricky if you need to add multiple tags to one event. with the processing pipelines you could create an array or make a multi value field … just that you know.

He is talking about “array” , “multi value field”, how can I do this with Pipelines ?

I tried all I can without success.

[dscryber (David Sciuto)]

Thanks for the question! Let me take a guess here. I’m sure it’ll be followed up by several of our expert users in the community.

Graylog’s processing pipelines allow you to modify and manipulate log messages as they are received. Can can create a multi-value field in Graylog, but you need to use the pipeline’s rules to split a single field into multiple fields using the split rule function. The split rule splits the field value by a specified delimiter (in this case, a comma). For example, let m = split(“,\t”, to_string($message.message));

Here’s an example from a community post:

Pipeline - Tab Split

Do you have examples of these messages you could share?

I hope this helps.

[benoitp]

Hello @dscryber

Yes, I can confirm that we can achieve this by using “split”

  let fields = split(",", to_string(myfield));
  set_field("new_tags", fields);

Thanks !