Pipeline Rule Builder - how to use input from on field, add domain to the input, and store as a new field

[fvr_flho (Flemming)]

Hi

I have log, where I will receive a field with a workstationname without domainname. As I want this to be a FQDN I want to create a new field with the workstation name + “mydomain.local”

I figured out the following souce code:

let new_field_value = concat(to_string($message.winlogbeat_winlog_event_data_Workstation), “.mydomain.local”);
set_field(“SourceFQDN”, new_field_value);

But how to do in the rule builder?

Best regards
/F

[fvr_flho (Flemming)]

bump - still hoping for someone