Hi guys, could’t find a solution anyhere so I hope someone here could help.
I am new to graylog and a complete beginner in Java.
I am getting logs from a windows machine and would like to make it very easy to find out who deleted a file on that computer using the windows event logs. The Windows event log gives me an object like this:
E:\SharedDrive\folder\folder\file.extension
The goal is to get the file name in its own separate field.
I wanted to do it with pipelines, so I am parsing my path with a rule:
rule “create a file_name field”
when
has_field(“ObjectName”)
then
let fix_message = replace(to_string($message.ObjectName), “\”, “+”);
let list = split("\+", fix_message);
set_field(“file_name”, list[1]);
end
Not a Java guy.
All I want is to get the last element of that parsed list:
set_field(“file_name”, list[-1])
so that I can have the actual file name.
I tried with set_field(“file_name”, list.get(list.size() - 1));
In fact, it doesn’t let me use list.size() anywhere in my code.
I can’t exoress how sorry I am for wasting your time if that’s just regular Java that I don’t get but do you think this solution would be possible?
Currently it’s displaying the file but in a somewhat hacky way using a bunch of stages for every possible position, some of which return errors as the element just isn’t there, but the file name does reliably show up in a separate field. It’s just a bit too hacky.