Pipeline rule: contains on list

Graylog Central (peer support)
,
1

Hi,
I have to implement a rule where check the tags field.
In this field we know that can be store more then one elements (like a List<String>). I need to check if contains a specific value (like Stream rule)

Is this possible on Pipeline rule? Can you give me an example?

Thanks
Gianluca

2

I can’t give you any example because I did not understand the request.

3

Sorry.
I need to create a rule to use it in a Pipeline.
In this rule I have a field myfield where I’d like to have a multivalue (it is similar to tags field that can contains more than one value when you use Collector Sidecar Configurations)

Like Collector Sidecar Configurations tags, I need to inspect the field values using contains.
Looking Stream I can create a similar rule ’ Field tags must contain myfield’ that we use to route event to a specific Stream.

Is this scenario feasible in pipeline rule?
Can I check tags value in where condition building a pipeline rule?
Fo example

where 
  $message.tags.contains("mick mouse")
then
  set_field(...)
4

Yes - that is total possible:

http://docs.graylog.org/en/3.0/pages/pipelines/functions.html#contains

5

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.