# Problem with pipeline rule

**URL:** <https://community.graylog.org/t/problem-with-pipeline-rule/16927>\
**Category:** Graylog Central (peer support)\
**Tags:** pipeline-rules\
**Created:** [August 26, 2020, 6:28am UTC](https://community.graylog.org/t/problem-with-pipeline-rule/16927 "2020-08-26T06:28:51Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![vyatchininm](https://avatars.discourse-cdn.com/v4/letter/v/b77776/32.png) [@vyatchininm](https://community.graylog.org/u/vyatchininm)\
**Post date:** [August 26, 2020, 6:28am UTC](https://community.graylog.org/t/problem-with-pipeline-rule/16927/1 "2020-08-26T06:28:51Z")

</div>

Hi!  
I have Graylog 3.3.5  
NXlog on server receive syslog messages and send them to Graylog with OutputType GELF\_TCP.  
I see messages in Graylog and put them into Stream “KSC Events”  
I create Pipeline to blacklist (filter) some messages and get problem with has\_field() function:  
For example has\_field(“event\_p2”) return False but this field exists:  
“field\_names”: [  
“SyslogFacility”,  
“gl2\_remote\_ip”,  
“gl2\_remote\_port”,  
“source”,  
“gl2\_source\_input”,  
“event\_hip”,  
“event\_p2”,  
“SeverityValue”,  
“MessageSourceAddress”,  
“SyslogSeverityValue”,  
“SyslogFacilityValue”,  
“gl2\_source\_node”,  
“event\_etdn”,  
“timestamp”,  
“MessageID”,  
“gl2\_accounted\_message\_size”,  
“SyslogSeverity”,  
“SourceModuleType”,  
“level”,  
“event\_et”,  
“streams”,  
“gl2\_message\_id”,  
“event\_hdn”,  
“SourceName”,  
“Severity”,  
“message”,  
“EventReceivedTime”,  
“SourceModuleName”,  
“full\_message”,  
“\_id”,  
“event\_tdn”,  
“event\_gn”  
],

 ![{640C76FE-CDAC-4524-ABDE-E047C019CD37}.png](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/5/539a94841d9e7bc3985fc2d082a0e63cc5e73e1c.jpeg)

Message processor Configuration:

1. Message Filter Chain (active)
2. Pipeline Processor (active)

All of these methods return False:  
has\_field(“event\_p2”)  
has\_field(“event\_etdn”)  
has\_field(“event\_hip”)  
has\_field(“event\_hdn”)

But has\_field(“SourceName”) return True

Please help me. Thank you.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [September 9, 2020, 6:28am UTC](https://community.graylog.org/t/problem-with-pipeline-rule/16927/2 "2020-09-09T06:28:52Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.