# NOT has\_field in pipeline rules

**URL:** https://community.graylog.org/t/not-has-field-in-pipeline-rules/12912
**Category:** Graylog Central (peer support)
**Tags:** route-to-streampl, debuggingpl, pipeline-rules
**Created:** [November 24, 2019, 1:30pm UTC](https://community.graylog.org/t/not-has-field-in-pipeline-rules/12912 "2019-11-24T13:30:37Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![Majdoline](https://avatars.discourse-cdn.com/v4/letter/m/a698b9/32.png) [@Majdoline](https://community.graylog.org/u/Majdoline)
#### Post date: [November 24, 2019, 1:30pm UTC](https://community.graylog.org/t/not-has-field-in-pipeline-rules/12912/1 "2019-11-24T13:30:38Z")

</div>

Dear,

I tried to use the function has\_field with (!) But it doesn’t work correctly to rout messages to a stream.  
Please advise

---

<div class="post-metadata">

### Author: ![shoothub](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/shoothub/32/6412_2.png) [@shoothub](https://community.graylog.org/u/shoothub)
#### Post date: [November 25, 2019, 8:10am UTC](https://community.graylog.org/t/not-has-field-in-pipeline-rules/12912/2 "2019-11-25T08:10:35Z")

</div>

Try to use debug message function to check if your rule match, or there is problem with routing messages:

```
let debug_message = concat("Match: ", to_string($message.timestamp));
let debug_message2 = concat(debug_message, to_string($message.message));
debug(debug_message2);

```

After that check your graylog logs and find if your condition match for message or not:  
`sudo tail -f /var/log/graylog-server/server.log`

---

<div class="post-metadata">

### Author: ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)
#### Post date: [November 25, 2019, 11:56am UTC](https://community.graylog.org/t/not-has-field-in-pipeline-rules/12912/3 "2019-11-25T11:56:48Z")

</div>

hey @Majdoline

> I tried to use the function has\_field with (!)

Do you mind to be a little more verbose? What did you tried exactly and what is not working?

In addition what Graylog Version did you use?

Thx

---

<div class="post-metadata">

### Author: ![Majdoline](https://avatars.discourse-cdn.com/v4/letter/m/a698b9/32.png) [@Majdoline](https://community.graylog.org/u/Majdoline)
#### Post date: [November 26, 2019, 6:26am UTC](https://community.graylog.org/t/not-has-field-in-pipeline-rules/12912/4 "2019-11-26T06:26:41Z")

</div>

Many thanks for your replys. I use 3.1 of graylog.  
It was an error in arranging the rules by stages.  
It works now “! has\_field()” and “NOT has\_fidld()”  
Thx

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)
#### Post date: [December 10, 2019, 6:40am UTC](https://community.graylog.org/t/not-has-field-in-pipeline-rules/12912/5 "2019-12-10T06:40:01Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.