Pipeline rule for adding actual source ip does not seem to do anything

Graylog Central (peer support)
1

Hey,

i tried to use gl2_remote_ip as a seperate field in my message. I already found a solution online, but it doesn’t work on my system. I use Syslog UDP as input.

So here is the pipeline rule. As you can see, i try to use gl2_remote_ip and store it in a seperate field… but as mentioned, nothing happens.

rule "Set Source IP"
when
  has_field("message")
then
  set_field("source-ip", to_string($message.gl2_remote_ip));
end

I also tried to use pipeline simulator with the following example message:
But it seems like

{
  "gl2_accounted_message_size": 232,
  "level": 7,
  "gl2_remote_ip": "10.51.156.182",
  "gl2_remote_port": 42946,
  "streams": [
    "000000000000000000000001"
  ],
  "gl2_message_id": "01HA4CZ9C0TPXZFX7VY7S4MC1P",
  "source": "platform[1188]:",
  "message": "platform[1188]: D/UI_LOG | Tech=Li-ionL St=Full H=Good Pres=1 Lv=99 Cy=0 Full=-1068287640 Cntr=0",
  "gl2_source_input": "64df3be74ec1023aeb7171b7",
  "facility_num": 1,
  "gl2_source_node": "a32ce306-1d59-4e49-b884-deb93327d8a5",
  "_id": "42b21800-5152-11ee-a5a4-0242a07289d2",
  "facility": "user-level",
  "timestamp": "2023-09-12T09:56:55.000Z"
}

Results:

Evaluate Rule 'Set Source IP' (650032958bb752777a927fc2) in Pipeline 'Set-Source-IP' (6500389b8bb752777a928c69)

Evaluation satisfied Rule 'Set Source IP' (650032958bb752777a927fc2) in Pipeline 'Set-Source-IP' (6500389b8bb752777a928c69)

Execute Rule 'Set Source IP' (650032958bb752777a927fc2) in Pipeline 'Set-Source-IP' (6500389b8bb752777a928c69)

But however, no field is added.

2

In the simulator, do you see a value in the remote ip field? Ie is there a value there for it to copy. Also I like to do a set_field pipelineran=true so that i can verify the rule ran, and narrow it down to the specific function being the issue.

3

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.