Pipeline remove ip in message

Graylog Central (peer support)
,
1

im trying to get rid of ip adress “10.10.10.10” in the $message
any hints? :slight_smile:

<166>Dec 4 13:05:27 10.10.10.10 Firewall1 %ASA-6-302020: Built inbound ICMP connection for faddr 10.52.31.10/0 gaddr 10.52.134.6/0 laddr 10.52.134.6/0 type 11 code 0

rule "[CISCO] remove snat ip in header "
when
has_field(“message”)
then

let string = regex_replace(
pattern:"\<(\S+)\>(\w+) (\w+) (\S+) (\S+)",
value: to_string($message.message),
replacement:"$1 $2 $3 $4");

//set_field(“test”, $message.message);

end

2

Is there a question here… looks more like a statement? :stuck_out_tongue:

Try using the debug() function to figure out what your results are.

debug(string);

The results will show in the graylog server log:

tail -f /var/log/graylog-server/server.log

3

great yes ill test thtat :slight_smile: added also the ? :wink:

1 Like
4

2020-12-07 13:00:39,125 INFO : org.graylog.plugins.pipelineprocessor.ast.functions.Function - PIPELINE DEBUG: <166>Dec 7 13:00:39 10.10.10.10 Firewall1 %ASA-6-302021: Teardown ICMP connection for faddr 10.52.31.10/0 gaddr 10.52.134.6/0 laddr 10.52.134.6/0 type 11 code 0

5

Oh boy. So… I am guessing that you are stuck again? Simply reposting the message and nothing else makes me guess that … but I don’t know what you did… post what you did, what you found… what does your entire rule look like now with the debug function in it? Use the formatting tools to make it easy to read… Otherwise I have to spend my personal time guessing… or writing this up… before you post more… perhaps read through this:

https://community.graylog.org/faq

6

Yes i only see the same output when enable debug mode in the pipeline.
Im running version 3.2.4 of graylog version
yes the regex match works tested it but still it wont replace.
i see the trace that its match in the pipeline and executed to, when i test it in simulator.
i only want to drop/replace the ip 10.10.10.10 in the message

the logmessage i tested on
<166>Dec 4 13:05:27 10.10.10.10 Firewall1 %ASA-6-302020: Built inbound ICMP connection for faddr 10.52.31.10/0 gaddr 10.52.134.6/0 laddr 10.52.134.6/0 type 11 code 0

Tested to change it like the example in doc.

rule "[CISCO] remove snat ip in message "
when
has_field(“message”) AND
contains(to_string($message.message), “10.10.10.10.”, true) OR
contains(to_string($message.message), “10.10.10.11”, true)
then

let string = regex_replace("\<(\d+)\>(\w+) (\d+) (\S+) (\S+).*", to_string($message.message), “$1 $2 $3 $4”);

end

7

If you want to replace original message with new one you also need this line:
set_field("message", string);

1 Like
8

great yes forgot that :slight_smile: but still wont work on 3.2.4 i tested this on 3.3.7 and i got the replace working directly :slight_smile:

9

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.