# Pipeline rule for adding actual source ip does not seem to do anything

**URL:** <https://community.graylog.org/t/pipeline-rule-for-adding-actual-source-ip-does-not-seem-to-do-anything/30076>\
**Category:** Graylog Central (peer support)\
**Tags:** pipeline-rules\
**Created:** [September 12, 2023, 10:16am UTC](https://community.graylog.org/t/pipeline-rule-for-adding-actual-source-ip-does-not-seem-to-do-anything/30076 "2023-09-12T10:16:59Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![nkre](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/nkre/32/15467_2.png) [@nkre](https://community.graylog.org/u/nkre)\
**Post date:** [September 12, 2023, 10:16am UTC](https://community.graylog.org/t/pipeline-rule-for-adding-actual-source-ip-does-not-seem-to-do-anything/30076/1 "2023-09-12T10:16:59Z")

</div>

Hey,

i tried to use gl2\_remote\_ip as a seperate field in my message. I already found a solution online, but it doesn’t work on my system. I use Syslog UDP as input.

So here is the pipeline rule. As you can see, i try to use gl2\_remote\_ip and store it in a seperate field… but as mentioned, nothing happens.

```auto
rule "Set Source IP"
when
  has_field("message")
then
  set_field("source-ip", to_string($message.gl2_remote_ip));
end

```

I also tried to use pipeline simulator with the following example message:  
But it seems like

```auto
{
  "gl2_accounted_message_size": 232,
  "level": 7,
  "gl2_remote_ip": "10.51.156.182",
  "gl2_remote_port": 42946,
  "streams": [
    "000000000000000000000001"
  ],
  "gl2_message_id": "01HA4CZ9C0TPXZFX7VY7S4MC1P",
  "source": "platform[1188]:",
  "message": "platform[1188]: D/UI_LOG | Tech=Li-ionL St=Full H=Good Pres=1 Lv=99 Cy=0 Full=-1068287640 Cntr=0",
  "gl2_source_input": "64df3be74ec1023aeb7171b7",
  "facility_num": 1,
  "gl2_source_node": "a32ce306-1d59-4e49-b884-deb93327d8a5",
  "_id": "42b21800-5152-11ee-a5a4-0242a07289d2",
  "facility": "user-level",
  "timestamp": "2023-09-12T09:56:55.000Z"
}

```

Results:

```auto
Evaluate Rule 'Set Source IP' (650032958bb752777a927fc2) in Pipeline 'Set-Source-IP' (6500389b8bb752777a928c69)

Evaluation satisfied Rule 'Set Source IP' (650032958bb752777a927fc2) in Pipeline 'Set-Source-IP' (6500389b8bb752777a928c69)

Execute Rule 'Set Source IP' (650032958bb752777a927fc2) in Pipeline 'Set-Source-IP' (6500389b8bb752777a928c69)

```

But however, no field is added.

---

<div class="post-metadata">

**Author:** ![Joel\_Duffield](https://avatars.discourse-cdn.com/v4/letter/j/71c47a/32.png) [@Joel\_Duffield](https://community.graylog.org/u/Joel_Duffield)\
**Post date:** [September 12, 2023, 12:02pm UTC](https://community.graylog.org/t/pipeline-rule-for-adding-actual-source-ip-does-not-seem-to-do-anything/30076/2 "2023-09-12T12:02:41Z")

</div>

In the simulator, do you see a value in the remote ip field? Ie is there a value there for it to copy. Also I like to do a set\_field pipelineran=true so that i can verify the rule ran, and narrow it down to the specific function being the issue.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [September 26, 2023, 12:03pm UTC](https://community.graylog.org/t/pipeline-rule-for-adding-actual-source-ip-does-not-seem-to-do-anything/30076/3 "2023-09-26T12:03:08Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.