Pipeline remove ip in message

im trying to get rid of ip adress “” in the $message
any hints? :slight_smile:

<166>Dec 4 13:05:27 Firewall1 %ASA-6-302020: Built inbound ICMP connection for faddr gaddr laddr type 11 code 0

rule "[CISCO] remove snat ip in header "

let string = regex_replace(
pattern:"\<(\S+)\>(\w+) (\w+) (\S+) (\S+)",
value: to_string($message.message),
replacement:"$1 $2 $3 $4");

//set_field(“test”, $message.message);


Is there a question here… looks more like a statement? :stuck_out_tongue:

Try using the debug() function to figure out what your results are.


The results will show in the graylog server log:

tail -f /var/log/graylog-server/server.log

great yes ill test thtat :slight_smile: added also the ? :wink:

1 Like

2020-12-07 13:00:39,125 INFO : org.graylog.plugins.pipelineprocessor.ast.functions.Function - PIPELINE DEBUG: <166>Dec 7 13:00:39 Firewall1 %ASA-6-302021: Teardown ICMP connection for faddr gaddr laddr type 11 code 0

Oh boy. So… I am guessing that you are stuck again? Simply reposting the message and nothing else makes me guess that … but I don’t know what you did… post what you did, what you found… what does your entire rule look like now with the debug function in it? Use the formatting tools to make it easy to read… Otherwise I have to spend my personal time guessing… or writing this up… before you post more… perhaps read through this:


Yes i only see the same output when enable debug mode in the pipeline.
Im running version 3.2.4 of graylog version
yes the regex match works tested it but still it wont replace.
i see the trace that its match in the pipeline and executed to, when i test it in simulator.
i only want to drop/replace the ip in the message

the logmessage i tested on
<166>Dec 4 13:05:27 Firewall1 %ASA-6-302020: Built inbound ICMP connection for faddr gaddr laddr type 11 code 0

Tested to change it like the example in doc.

rule "[CISCO] remove snat ip in message "
has_field(“message”) AND
contains(to_string($message.message), “”, true) OR
contains(to_string($message.message), “”, true)

let string = regex_replace("\<(\d+)\>(\w+) (\d+) (\S+) (\S+).*", to_string($message.message), “$1 $2 $3 $4”);


If you want to replace original message with new one you also need this line:
set_field("message", string);

1 Like

great yes forgot that :slight_smile: but still wont work on 3.2.4 i tested this on 3.3.7 and i got the replace working directly :slight_smile:

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.