# Pipeline Stages - strange behavior

**URL:** <https://community.graylog.org/t/pipeline-stages-strange-behavior/13822>\
**Category:** Graylog Central (peer support)\
**Tags:** pipeline-rules\
**Created:** [February 6, 2020, 7:49am UTC](https://community.graylog.org/t/pipeline-stages-strange-behavior/13822 "2020-02-06T07:49:25Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![ReZoo](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/rezoo/32/5723_2.png) [@ReZoo](https://community.graylog.org/u/ReZoo)\
**Post date:** [February 6, 2020, 7:49am UTC](https://community.graylog.org/t/pipeline-stages-strange-behavior/13822/1 "2020-02-06T07:49:25Z")

</div>

I made two rules and if they are at one stage then everything works, if I put one rule into another stage, then it does not work.

Is this true or am I doing something wrong?

---

<div class="post-metadata">

**Author:** ![ReZoo](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/rezoo/32/5723_2.png) [@ReZoo](https://community.graylog.org/u/ReZoo)\
**Post date:** [February 6, 2020, 8:26am UTC](https://community.graylog.org/t/pipeline-stages-strange-behavior/13822/2 "2020-02-06T08:26:45Z")

</div>

i have to make a new Pipeline?

---

<div class="post-metadata">

**Author:** ![shoothub](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/shoothub/32/6412_2.png) [@shoothub](https://community.graylog.org/u/shoothub)\
**Post date:** [February 6, 2020, 8:39am UTC](https://community.graylog.org/t/pipeline-stages-strange-behavior/13822/3 "2020-02-06T08:39:12Z")

</div>

Please post your pipeline configuration.

I only guess, but you probably put 2 pipeline rules to stage and setup:

> Continue processing on next stage when: At least one of the rules on this stage matches the message

This way, both of rules are evaluated, but if you put one to another stage, it’s not working. So your condition in rules are wrong. Please put your configuration, so we can help…

---

<div class="post-metadata">

**Author:** ![ReZoo](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/rezoo/32/5723_2.png) [@ReZoo](https://community.graylog.org/u/ReZoo)\
**Post date:** [February 6, 2020, 8:57am UTC](https://community.graylog.org/t/pipeline-stages-strange-behavior/13822/4 "2020-02-06T08:57:36Z")

</div>

Hi, shoothub!

```
rule "timestampEND"

when
has_field("Category") AND contains(to_string($message.Category), "Process Termination")

then

 rename_field("timestamp", "timestampEND");
end 

```

And

```
rule "timestampSTART"

when
has_field("Category") AND contains(to_string($message.Category), "Process Creation")

then

 rename_field("timestamp", "timestampSTART");
end
```

---

<div class="post-metadata">

**Author:** ![shoothub](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/shoothub/32/6412_2.png) [@shoothub](https://community.graylog.org/u/shoothub)\
**Post date:** [February 6, 2020, 9:12am UTC](https://community.graylog.org/t/pipeline-stages-strange-behavior/13822/5 "2020-02-06T09:12:06Z")

</div>

You created it correctly, if you put both of rules in one Stage. This way both of them are evaluated, and works (if you setup _Stage as: At least one of the rules on this stage matches the message_ = logical OR)

If you try to put one of the rule to another stage is isn’t working, which is OK, because graylog only run another stage, if lower stage pass, so it’s like a tree. It works as:

> If Stage0 pass (one of rule match, or all of rules match - depends on configuration of Stage), then continue to Stage1 etc.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [February 20, 2020, 9:12am UTC](https://community.graylog.org/t/pipeline-stages-strange-behavior/13822/6 "2020-02-20T09:12:46Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.