@jan
I have found a similar use-case on thread Pipeline rule: Escaping brackets in grok template but unanswered.
I have tried creating a pipeline rule for the use case described above but getting the errors undermentioned. Please let me know where am I going wrong and it’s workaround.
Rule definition:
rule “process_when_message_contains_failed”
when
(has_field(“message”) AND contains(“failed”))
then
let message_field = to_string($message.message);
let grokpattern = “[%{TIMESTAMP_ISO8601:logtime}] %{USERNAME:eventUser} %{WORD:event} [%{NUMBER:jobID}:%{WORD:state}] %{DATA:rundeckProject} %{GREEDYDATA}”;
let nexus = grok(pattern: $grokpattern, value: $message_field, only_named_captures: true);
end
Error message:
