Pipeline Rule Builder - how to use input from on field, add domain to the input, and store as a new field


I have log, where I will receive a field with a workstationname without domainname. As I want this to be a FQDN I want to create a new field with the workstation name + “mydomain.local”

I figured out the following souce code:

let new_field_value = concat(to_string($message.winlogbeat_winlog_event_data_Workstation), “.mydomain.local”);
set_field(“SourceFQDN”, new_field_value);

But how to do in the rule builder?

Best regards

bump - still hoping for someone :slight_smile:

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.