# Pipeline Rule for Changing Type Based on Port Number **URL:** \ **Category:** Graylog Central (peer support)\ **Created:** [January 26, 2023, 5:30pm UTC](https://community.graylog.org/t/pipeline-rule-for-changing-type-based-on-port-number/27460 "2023-01-26T17:30:19Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Linedo](https://avatars.discourse-cdn.com/v4/letter/l/c89c15/32.png) [@Linedo](https://community.graylog.org/u/Linedo)\ **Post date:** [January 26, 2023, 5:30pm UTC](https://community.graylog.org/t/pipeline-rule-for-changing-type-based-on-port-number/27460/1 "2023-01-26T17:30:19Z")
Hi, so I have a regex extractor that populates a field called “packet\_destination\_port” based on the message, this works correctly. I then want to have a pipeline rule that changes the “type” field to “failed\_remote\_session” if the destination port is 22, 80, 443, 3389 (in this example just port 22 for simplicity). ```auto rule "Type = failed_remote_session" when has_field("packet_destination_port") && to_long($message.packet_destination_port) == 22 then set_field("type", "failed_remote_session"); end ``` However, when I simulate processing a message with the field packet\_destination\_port:22, it does not satisfy the rule requirements. I think this is because the packet\_destination\_port is extracted as an object and it’s failing to convert the object to a long (number). I have tried adding a numeric converter to the extractor, I have tried using _to\_string_ and _== “22”_ instead of long. I have tried creating a rule that stores the packet\_destination\_port field as a variable and re-sets the field as a long. No success. Does anyone have any suggestions of how to get round this? Am I doing something wrong? ---
**Author:** ![dscryber](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/dscryber/32/14178_2.png) [@dscryber](https://community.graylog.org/u/dscryber)\ **Post date:** [January 26, 2023, 5:54pm UTC](https://community.graylog.org/t/pipeline-rule-for-changing-type-based-on-port-number/27460/2 "2023-01-26T17:54:57Z")
Hey, Linden, Thanks for asking in the community. What follows are guesses based on what you’ve posted. We have a lot of experienced practitioners in the community who also may want to post to help you out. Is it possible that the data type of the “packet\_destination\_port” field is being extracted as an object, rather than a numeric value (string vs numeric)? One thought is to use a pipeline processor to convert the “packet\_destination\_port” field from an object to a numeric value (e.g. long or int) before the pipeline rule is applied. Or maybe use the to\_string() function to convert the object to string, and then using == “22” instead of to\_long(). You can try to check the data type of the field using type\_of() function and take appropriate action accordingly. Last, I’m thinking that maybe that there is an issue with the extractor configuration or the way the message is sent to Graylog.Double-checking these elements to ensure that the “packet\_destination\_port” field is being extracted correctly. I hope this helps. ---
**Author:** ![gsmith](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gsmith/32/1222_2.png) [@gsmith](https://community.graylog.org/u/gsmith)\ **Post date:** [January 26, 2023, 11:30pm UTC](https://community.graylog.org/t/pipeline-rule-for-changing-type-based-on-port-number/27460/3 "2023-01-26T23:30:39Z")
Hey @Linedo Perhaps something like this ```auto rule "failed_remote_session" when has_field("packet_destination_port") AND contains(to_string($message.packet_destination_port), "22") then set_field("failed_remote_session","batman"); end ``` ---
**Author:** ![Linedo](https://avatars.discourse-cdn.com/v4/letter/l/c89c15/32.png) [@Linedo](https://community.graylog.org/u/Linedo)\ **Post date:** [January 27, 2023, 3:22pm UTC](https://community.graylog.org/t/pipeline-rule-for-changing-type-based-on-port-number/27460/4 "2023-01-27T15:22:50Z")
Hi @gsmith and @dscyber, thankyou very much for your resonses! Turns out I was just being stupid, I thought I had added a numeric converter to the extractor but I didn’t click “Add” before updating and closing the extractor. Now it is not extracting as an object type it can be converted into a string/long data type. This might also be a dumb question, but does anyone know the reason objects cannot be converted into other data types? ---
**Author:** ![gsmith](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gsmith/32/1222_2.png) [@gsmith](https://community.graylog.org/u/gsmith)\ **Post date:** [January 27, 2023, 10:34pm UTC](https://community.graylog.org/t/pipeline-rule-for-changing-type-based-on-port-number/27460/5 "2023-01-27T22:34:49Z")
Hey > [@Linedo](#): > > This might also be a dumb question, but does anyone know the reason objects cannot be converted into other data types? In Java, every variable has a data type and stores a value of that type. Data types, or types for short, are divided into two categories: primitive and non-primitive. There are eight primitive types in Java: **byte** , **short** , **int** , **long** , **float** , **double** , **boolean** and **char**. These built-in types describe variables that store single values of a predefined format and size. Is this what your referring to? ---
**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\ **Post date:** [February 10, 2023, 10:35pm UTC](https://community.graylog.org/t/pipeline-rule-for-changing-type-based-on-port-number/27460/6 "2023-02-10T22:35:23Z")
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.