Pipllines and the grok-function

[gsmith]

Hello,
I might be able to help but I’m not that great in pipelines.
From what I seeing in your error…

@ihe

In call to function 'grok' at 5:12 an exception was thrown:

I think it maybe something with this let val = From what I glanced at other posts perhaps it suppose to be just

grok( pattern:"%{WORD:part_1) %{WORD:part_2)", value:to_string($message.message));

Have after looking at this maybe a comma between…

pattern:"%{WORD:part_1), %{WORD:part_2)",

So I looked here and was unable to see this function let val=

https://docs.graylog.org/docs/functions

When you created this pipeline/rule you can test it out in the Simulator. Have you tried that? Then you can change the results if you wish.

I did a quick search for this situation maybe some of this posts perhaps have hints within them that may help.

Pipeline Grok Patterns

Hello Can you please help me. I want parsed log file secure on linux like filebeat in module. For Example filebeat has this rule for file secure: "%{SYSLOGTIMESTAMP:system.auth.timestamp} %{SYSLOGHOST:system.auth.hostname} sshd(?:\\[%{POSINT:system.auth.pid}\\])?: %{DATA:system.auth.ssh.event} %{DATA:system.auth.ssh.method} for (invalid user )?%{DATA:system.auth.user} from %{IPORHOST:system.auth.ssh.ip} port %{NUMBER:system.auth.ssh.port} ssh2(: %{GREEDYDATA:system.auth.ssh.signature})?", "%…

Adjust grok() pipeline function when pattern exists but match fails

Solved: Problem with pipeline rule and grok pattern

Hello everybody, i am Dirk from Germany. I am a newbie with graylog. The most of my problems i solved with good inet documentation and youtube :-). But now i have a problem with the pipelines rules and a grok pattern. The following grok pattern works fine within the extracttor. action=%{QUOTEDSTRING:action}\s*.*\s*srcip=\"%{IPV4:SourceIP}\"\s*dstip=\"%{IPV4:DestinationIP}\"\s*.*\s*srcport=\"%{POSINT:SourcePORT}\"\s*dstport=\"%{POSINT:DestinationPORT}\" But the follwoing code for the pipeline…

Pipeline grok syntax

Got it. The answer to both my questions. In Filebeats add a field ‘document_type’ and set to the type of log file you want parsed. In the below example I’m parsing the type ‘log4j’. In order to get the timestamp to be recognized as the “valid” one, you have to parse it as a date. In addition I’m saving the full original log line as “original_message”. Create the rule and add it to the ‘all messages’ stream. rule "parse log4j" when has_field(“document_type”) && to_string($message.document_typ…

Grok Pipeline only_named_captures

you could have also used: let nexus = grok(pattern: "%{GROKPATTERNS}", value: message_field, only_named_captures: true); To be more human readable.

Pipeline Rule not working - Source replace with grok

Hello, I am trying to do a simple replace of the source from where I get syslogs as its currently not correct. I have been playing with this for quite some time but I cant get it to work. If I use this same grok command on an extractor I get exactly what I want but not in the rule. Sorry very new… rule "FQDN to Source" when has_field("message") then let extract = grok(pattern: "\\s%{HOSTNAME}", value: to_string($message.source)); set_fields(extract); end