Hi.
We have a JSON log from the client. We create Raw/plaintext input and create extractor JSON and in configuration priority is Message Filter chain >> Pipeline Processor >> GeoIP Resolver we have no problem so far, we need change fields with pipeline and when we want to use has_field function in when section this function not work. but we don’t have a problem with a field in then section. please look at the my pipeline
rule "RouteData"
when
from_input("5e8c0edb50401d5943c76fcf")
then
let temp_message_0 = concat("Route matched with ",to_string($message.Properties_RouteData));
let temp_message_1 = concat(temp_message_0," Executing controller action with signature ");
let temp_message_2 = concat(temp_message_1,to_string($message.Properties_MethodInfo));
let temp_message_3 = concat(temp_message_2," on controller ");
let temp_message_4 = concat(temp_message_3,to_string($message.Properties_Controller));
let temp_message_5 = concat(temp_message_4,to_string($message.Properties_AssemblyName));
set_field("NewTemplate", temp_message_5 );
end
this is rule is correct and no problem. but we want check exist some filed so edit rule and we rule not work.
rule "RouteData"
when
from_input("5e8c0edb50401d5943c76fcf") AND
has_field(to_string($message.Properties_RouteData))
then
let temp_message_0 = concat("Route matched with ",to_string($message.Properties_RouteData));
let temp_message_1 = concat(temp_message_0," Executing controller action with signature ");
let temp_message_2 = concat(temp_message_1,to_string($message.Properties_MethodInfo));
let temp_message_3 = concat(temp_message_2," on controller ");
let temp_message_4 = concat(temp_message_3,to_string($message.Properties_Controller));
let temp_message_5 = concat(temp_message_4,to_string($message.Properties_AssemblyName));
set_field("NewTemplate", temp_message_5 );
end
Or
rule "RouteData"
when
from_input("5e8c0edb50401d5943c76fcf") AND
contains("Route matched with",to_string($message.message))
then
let temp_message_0 = concat("Route matched with ",to_string($message.Properties_RouteData));
let temp_message_1 = concat(temp_message_0," Executing controller action with signature ");
let temp_message_2 = concat(temp_message_1,to_string($message.Properties_MethodInfo));
let temp_message_3 = concat(temp_message_2," on controller ");
let temp_message_4 = concat(temp_message_3,to_string($message.Properties_Controller));
let temp_message_5 = concat(temp_message_4,to_string($message.Properties_AssemblyName));
set_field("NewTemplate", temp_message_5 );
end
why ($message.Properties_RouteData) in when section and our condition does not work?!
thanks.