# Pipeline Rule - Drop messages with field containing IP

**URL:** <https://community.graylog.org/t/pipeline-rule-drop-messages-with-field-containing-ip/19065>\
**Category:** Graylog Central (peer support)\
**Tags:** pipeline-rules, debuggingpl\
**Created:** [March 10, 2021, 2:46pm UTC](https://community.graylog.org/t/pipeline-rule-drop-messages-with-field-containing-ip/19065 "2021-03-10T14:46:45Z")\
**Posts on this page:** 1\
**Showing post:** 4

<div class="post-metadata">

**Author:** ![tmacgbay](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/tmacgbay/32/3878_2.png) [@tmacgbay](https://community.graylog.org/u/tmacgbay)\
**Post date:** [March 11, 2021, 11:43am UTC](https://community.graylog.org/t/pipeline-rule-drop-messages-with-field-containing-ip/19065/4 "2021-03-11T11:43:09Z")

</div>

you can use the `debug()` function and watch what it’s output is in the Graylog logs:

`tail -f /var/log/graylog-server/server.log`

```
rule "Drop NAT from specific Subnet"
when
    starts_with(to_string($message.Int_Src_IP), "172.16.40")
then
    debug("Source IP match:");
    debug(to_string($message.Int_Src_IP));
    drop_message();
end

```

if nothing shows you can change the when to `has_field("Int_Src_IP")` just to make sure you get to the debug

[Debug Function - Graylog 4.0](https://docs.graylog.org/en/4.0/pages/pipelines/functions.html#debug)

---

_[View the full topic](https://community.graylog.org/t/pipeline-rule-drop-messages-with-field-containing-ip/19065)._