Pipelines not working

[tomsi (Tomasz)]

Hello,

I want to summarize the Values of one field.
The use case is very simple, i receive Windows Event Logs with the field:
winlogbeat_winlog_event_data_TargetDomainName

Now, sometimes the Domain “abc” is used, and sometimes the FQDN: “abc.domain”.
We really dont care which one is getting used, so i want to transform the value “abc” to “abc.domain” in order to reduce noise.

I configured the following Pipeline rule:

rule "summarize domain"
when
    has_field("winlogbeat_winlog_event_data_TargetDomainName") &&
    contains("winlogbeat_winlog_event_data_TargetDomainName","abc")
then
    set_field("winlogbeat_winlog_event_data_TargetDomainName","abc.domain");
end

The Pipeline is connected to the stream where the Eventlogs land.
The Problem is that the rule apparently never matches and the values are not getting transformed.

What am i missing?

[patrickmann]

You are specifying a string value instead of a field name. I think it should be this:

has_field("winlogbeat_winlog_event_data_TargetDomainName") &&
contains(to_string($message.winlogbeat_winlog_event_data_TargetDomainName),"abc")