Pipeline Rule Editor Fails on Basic 'if' Syntax in Graylog 5.2 (Docker)

Graylog Central (peer support)
1

Environment:

  • Graylog Version: 5.2.x (graylog/graylog:5.2) running via Docker Compose.
  • Elasticsearch Version: 7.10.2 (Docker).

  • MongoDB Version: 5.0 (Docker).

  • Host: Running on a Proxmox VM.

  • VM CPU Type: Haswell-noTSX 

  • Host OS : Proxmox VE

The Problem: the pipeline rule editor consistently shows syntax errors for the most basic if <condition> then ... end; structure.

rule “Syntax Test If Basic”
when
has_field(“message”)
then
if true then
set_field(“syntax_test_if_worked”, true);
end;
end

Error Messages: the exact errors shown by the editor (e.g., Unknown function if in line 5 pos 4, mismatched input 'then' expecting {...}, missing '(' at 'true').

  • Occurred in both Graylog 4.3.15 and 5.2.
  • Code was manually typed (not just copy-pasted).
  • Basic rules without if statements seem to save okay (like the MME rule attempt before adding the inner if).

Is this a issue,or I am doing something wrong ?

Thanks.

2

Did you happen to get that from chatgpt, because if is not a thing in pipeline rules you get when, then, end and then functions inside the first two, thats it.