# Pipeline rules to drop unnecessary messages

**URL:** <https://community.graylog.org/t/pipeline-rules-to-drop-unnecessary-messages/4107>\
**Category:** Graylog Central (peer support)\
**Tags:** pipeline-rules\
**Created:** [February 9, 2018, 9:48am UTC](https://community.graylog.org/t/pipeline-rules-to-drop-unnecessary-messages/4107 "2018-02-09T09:48:01Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![m1ster1985](https://avatars.discourse-cdn.com/v4/letter/m/ee7513/32.png) [@m1ster1985](https://community.graylog.org/u/m1ster1985)\
**Post date:** [February 9, 2018, 9:48am UTC](https://community.graylog.org/t/pipeline-rules-to-drop-unnecessary-messages/4107/1 "2018-02-09T09:48:01Z")

</div>

Hi all,  
Could you help me to write a rule to drop unnecessary messages before they are written into indexes.  
I have messages as the following

**full\_message**

```auto
<164>Feb 09 2018 14:48:02 fwmain: %ASA: Deny tcp src inside:xxx.xxx.xxx.xx/9372 dst outside:xxx.xxx.xxx.xxx/445 by access-group "acl_in" [0x0, 0x0]

```

**message**

```auto
Feb 09 2018 14:48:02 fwmain: %ASA: Deny tcp src inside:xxx.xxx.xxx.xxx/9372 dst outside:xxx.xxx.xxx.xxx/445 by access-group "acl_in" [0x0, 0x0]
source

```

How can I drop messages using matching with phrase "Deny tcp src inside"  
I tried to use the following rule but it doesn’t work.

```auto
rule "Drop unnecessary messages"
when
 $message.message == "Deny tcp src inside"
then
    drop_message();
end

```

---

<div class="post-metadata">

**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\
**Post date:** [February 9, 2018, 9:58am UTC](https://community.graylog.org/t/pipeline-rules-to-drop-unnecessary-messages/4107/2 "2018-02-09T09:58:09Z")

</div>

Take a look at the [`contains()`](http://docs.graylog.org/en/2.4/pages/pipelines/functions.html#contains) function.

---

<div class="post-metadata">

**Author:** ![m1ster1985](https://avatars.discourse-cdn.com/v4/letter/m/ee7513/32.png) [@m1ster1985](https://community.graylog.org/u/m1ster1985)\
**Post date:** [February 9, 2018, 6:10pm UTC](https://community.graylog.org/t/pipeline-rules-to-drop-unnecessary-messages/4107/3 "2018-02-09T18:10:48Z")

</div>

Thank you. Indeed, contains function is exactly what I need.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [February 23, 2018, 6:11pm UTC](https://community.graylog.org/t/pipeline-rules-to-drop-unnecessary-messages/4107/4 "2018-02-23T18:11:07Z")

</div>

Closed on February 23, 2018, 6:11pm UTC

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.