Pipeline Rule - Drop messages with field containing IP

Graylog Central (peer support)
,
4

you can use the debug() function and watch what it’s output is in the Graylog logs:

tail -f /var/log/graylog-server/server.log

rule "Drop NAT from specific Subnet"
when
    starts_with(to_string($message.Int_Src_IP), "172.16.40")
then
    debug("Source IP match:");
    debug(to_string($message.Int_Src_IP));
    drop_message();
end

if nothing shows you can change the when to has_field("Int_Src_IP") just to make sure you get to the debug

Debug Function - Graylog 4.0