Pipeline to Overriding facility with additional _facility field

[n3xus]

I’m trying to write a rule to override “facility” with “_facility” but not working. Can you tell me what I’m doing wrong?

rule "override facility field with _facility"
when
    has_field("_facility")
then
    set_field("facility", $message._facility);
end

[jochen]

Have you connected the rule to the correct pipeline and the pipeline to the correct stream?

See http://docs.graylog.org/en/2.2/pages/pipelines/usage.html for details.