Problem with to_ip set_field()

[paulox]

Thanks for the reply.

I must say that I’m curious about your answer. If I take a look at many other topics in this forum, I can get many results of the usage of the to{ip, string, double, …}()_ function, e.g:

Failing JSON Extractor

Hi I’m quite new to Graylog configuration. I’m trying to set up a Filebeat input where there’s JSON single line events in the log files, like this: { “time”: “2018-12-07 12:56:12.2948”, “level”: “INFO”, “message”: “This is log event number 93 generated randomly in batch 374fa6d5-253a-4111-b274-f780a4255d47”, “CorrelationID”: “36835d49-c68e-4bb8-91e2-28954217e0a2”, “SessionID”: “6869282”, “Component”: “APP”, “ComponentVersion”: “1.5.0.0”, “Action”: “SEARCH”, “Method”: “SeachBook”, “MemberID”: “…

As soon as I modify my rule to use another of the to_double(), in the set_field(), the rule runs smoothly.

I have many IP possible data fields; are you telling me that I will have to create a template to handle all of them? It seems to me that IP is a common data type.

Thanks for the help.