# Pipeline rule error

**URL:** <https://community.graylog.org/t/pipeline-rule-error/3222>\
**Category:** Graylog Central (peer support)\
**Tags:** pipeline-rules\
**Created:** [November 20, 2017, 1:33pm UTC](https://community.graylog.org/t/pipeline-rule-error/3222 "2017-11-20T13:33:32Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![haywhai](https://avatars.discourse-cdn.com/v4/letter/h/bbe5ce/32.png) [@haywhai](https://community.graylog.org/u/haywhai)\
**Post date:** [November 20, 2017, 1:33pm UTC](https://community.graylog.org/t/pipeline-rule-error/3222/1 "2017-11-20T13:33:32Z")

</div>

Please why isnt this working? I want to get a field after a successful windows login.

rule "successful logons"  
when  
has\_field(“externalId : 4624”)

then  
let success = concat(to\_string($message.externalId), “-”);

set\_field(field:“successful”, value: success);  
end

---

<div class="post-metadata">

**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\
**Post date:** [November 20, 2017, 1:51pm UTC](https://community.graylog.org/t/pipeline-rule-error/3222/2 "2017-11-20T13:51:04Z")

</div>

The `has_field()` function only checks if the specified message field exists. I doubt that you’re really trying to check for a field named “externalId: 4624”. You probably want to check the value of the message field named “externalId”.

Example:

```auto
when
  has_field("externalId") &&
  to_long($message.externalId) == 4624
then
  // ...
end

```

Maybe take a look at the following blog post for some inspiration:  
[https://www.graylog.org/blog/83-back-to-basics-enhance-windows-security-with-sysmon-and-graylog](https://www.graylog.org/blog/83-back-to-basics-enhance-windows-security-with-sysmon-and-graylog)

---

<div class="post-metadata">

**Author:** ![haywhai](https://avatars.discourse-cdn.com/v4/letter/h/bbe5ce/32.png) [@haywhai](https://community.graylog.org/u/haywhai)\
**Post date:** [November 20, 2017, 1:59pm UTC](https://community.graylog.org/t/pipeline-rule-error/3222/3 "2017-11-20T13:59:54Z")

</div>

Thanks J. I checked the link you sent and it was helpful. What happens if i want to set a new field inside the “then” part of the above code. can this work?? I already tried it but didnt see it amongst d searched field

rule "successful logons"  
when  
has\_field(“externalId”) &&  
to\_long($message.externalId) == 4624  
then  
set\_field(field:“successful”, value: 4624);  
end

---

<div class="post-metadata">

**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\
**Post date:** [November 20, 2017, 2:26pm UTC](https://community.graylog.org/t/pipeline-rule-error/3222/4 "2017-11-20T14:26:35Z")

</div>

> [@haywhai](#):
>
> What happens if i want to set a new field inside the “then” part of the above code. can this work??

Yes, this would work.

---

<div class="post-metadata">

**Author:** ![haywhai](https://avatars.discourse-cdn.com/v4/letter/h/bbe5ce/32.png) [@haywhai](https://community.graylog.org/u/haywhai)\
**Post date:** [November 20, 2017, 2:27pm UTC](https://community.graylog.org/t/pipeline-rule-error/3222/5 "2017-11-20T14:27:41Z")

</div>

So J, you are saying this should work and i should see the new field i created?

rule "successful logons"  
when  
has\_field(“externalId”) &&  
to\_long($message.externalId) == 4624  
then  
set\_field(field:“successful”, value: 4624);  
end

---

<div class="post-metadata">

**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\
**Post date:** [November 20, 2017, 2:29pm UTC](https://community.graylog.org/t/pipeline-rule-error/3222/6 "2017-11-20T14:29:20Z")

</div>

> [@haywhai](#):
>
> So J, you are saying this should work and i should see the new field i created?

Yes, that’s what I wrote.

---

<div class="post-metadata">

**Author:** ![haywhai](https://avatars.discourse-cdn.com/v4/letter/h/bbe5ce/32.png) [@haywhai](https://community.graylog.org/u/haywhai)\
**Post date:** [November 21, 2017, 7:18am UTC](https://community.graylog.org/t/pipeline-rule-error/3222/7 "2017-11-21T07:18:57Z")

</div>

Thanks J…I tried it and it worked.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [December 5, 2017, 7:19am UTC](https://community.graylog.org/t/pipeline-rule-error/3222/8 "2017-12-05T07:19:05Z")

</div>

Closed on December 5, 2017, 7:19am UTC

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.