# Pipeline doesn't work

**URL:** <https://community.graylog.org/t/pipeline-doesnt-work/14139>\
**Category:** Graylog Central (peer support)\
**Tags:** pipeline-rules, debuggingpl\
**Created:** [February 24, 2020, 3:04pm UTC](https://community.graylog.org/t/pipeline-doesnt-work/14139 "2020-02-24T15:04:02Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![veninmiha](https://avatars.discourse-cdn.com/v4/letter/v/a88e57/32.png) [@veninmiha](https://community.graylog.org/u/veninmiha)\
**Post date:** [February 24, 2020, 3:04pm UTC](https://community.graylog.org/t/pipeline-doesnt-work/14139/1 "2020-02-24T15:04:02Z")

</div>

Hi Guys,  
I need to drop all the messages which contains a certain IP and i’ve wrote the following rule:  
rule “False\_Positive”  
when  
has\_field(“message”) AND  
contains(“192.168.1.78”,to\_string($message.message))  
then  
drop\_message();  
end

the configuration is:  
Processor Status  
1 Message Filter Chain active  
2 Pipeline Processor active  
3 GeoIP Resolver active

Unfortunately nothing is happen and the logs which contains the above IP are still on my dashboard.  
Any idea where the problem could be?  
Thanks  
Laurentiu

---

<div class="post-metadata">

**Author:** ![tmacgbay](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/tmacgbay/32/3878_2.png) [@tmacgbay](https://community.graylog.org/u/tmacgbay)\
**Post date:** [February 24, 2020, 5:20pm UTC](https://community.graylog.org/t/pipeline-doesnt-work/14139/2 "2020-02-24T17:20:24Z")

</div>

use debug() to see what is going on. For instance:

```
rule “False_Positive”
when
    has_field(“message”) AND
    contains(“192.168.1.78”,to_string($message.message))
then
    debug("-- Start of FP THEN --");
    let izzittrue = concat("~~~IP was found: ", to_string(contains("192.168.2.182",to_string($message.message))));
    debug(izzittrue);
    debug($message.message);
    drop_message();
end

```

Monitor with:

```
tail -f /var/log/graylog-server/server.log
```

---

<div class="post-metadata">

**Author:** ![Ponet](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/ponet/32/2131_2.png) [@Ponet](https://community.graylog.org/u/Ponet)\
**Post date:** [February 24, 2020, 5:26pm UTC](https://community.graylog.org/t/pipeline-doesnt-work/14139/3 "2020-02-24T17:26:18Z")

</div>

You may need to swap your parameters around, as per the documentation:

 ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/c/c18056a221eeb79f703216d3d9d20fe135392a4f.png)

[https://docs.graylog.org/en/latest/pages/pipelines/functions.html#contains](https://docs.graylog.org/en/latest/pages/pipelines/functions.html#contains)

---

<div class="post-metadata">

**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\
**Post date:** [February 25, 2020, 9:01am UTC](https://community.graylog.org/t/pipeline-doesnt-work/14139/4 "2020-02-25T09:01:53Z")

</div>

yes - swap is one option - the other - name the parameters…

```auto
contains(search: “192.168.1.78”, value:to_string($message.message))

```

---

<div class="post-metadata">

**Author:** ![veninmiha](https://avatars.discourse-cdn.com/v4/letter/v/a88e57/32.png) [@veninmiha](https://community.graylog.org/u/veninmiha)\
**Post date:** [February 26, 2020, 8:02am UTC](https://community.graylog.org/t/pipeline-doesnt-work/14139/5 "2020-02-26T08:02:40Z")

</div>

It seems that this is the good solution. Thanks

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [March 11, 2020, 8:02am UTC](https://community.graylog.org/t/pipeline-doesnt-work/14139/6 "2020-03-11T08:02:44Z")

</div>

Closed on March 11, 2020, 8:02am UTC

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.