# Problem with when section in pipeline

**URL:** <https://community.graylog.org/t/problem-with-when-section-in-pipeline/14902>\
**Category:** Graylog Central (peer support)\
**Tags:** pipeline-rules\
**Created:** [April 9, 2020, 5:12pm UTC](https://community.graylog.org/t/problem-with-when-section-in-pipeline/14902 "2020-04-09T17:12:41Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![david\_graylog13](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/david_graylog13/32/5152_2.png) [@david\_graylog13](https://community.graylog.org/u/david_graylog13)\
**Post date:** [April 9, 2020, 5:12pm UTC](https://community.graylog.org/t/problem-with-when-section-in-pipeline/14902/1 "2020-04-09T17:12:41Z")

</div>

Hi.  
We have a JSON log from the client. We create `Raw/plaintext` input and create extractor JSON and in configuration priority is `Message Filter chain` \>\> `Pipeline Processor` \>\> `GeoIP Resolver` we have no problem so far, we need change fields with pipeline and when we want to use `has_field` function in `when section` this function not work. but we don’t have a problem with a field in `then section`. please look at the my pipeline

```auto
rule "RouteData"
when
 from_input("5e8c0edb50401d5943c76fcf") 
then
   let temp_message_0 = concat("Route matched with ",to_string($message.Properties_RouteData));
   let temp_message_1 = concat(temp_message_0," Executing controller action with signature ");
   let temp_message_2 = concat(temp_message_1,to_string($message.Properties_MethodInfo));
   let temp_message_3 = concat(temp_message_2," on controller ");
   let temp_message_4 = concat(temp_message_3,to_string($message.Properties_Controller));
   let temp_message_5 = concat(temp_message_4,to_string($message.Properties_AssemblyName));
   set_field("NewTemplate", temp_message_5 );
end

```

this is rule is correct and no problem. but we want check exist some filed so edit rule and we rule not work.

```auto
rule "RouteData"
when
 from_input("5e8c0edb50401d5943c76fcf") AND
 has_field(to_string($message.Properties_RouteData))
then
   let temp_message_0 = concat("Route matched with ",to_string($message.Properties_RouteData));
   let temp_message_1 = concat(temp_message_0," Executing controller action with signature ");
   let temp_message_2 = concat(temp_message_1,to_string($message.Properties_MethodInfo));
   let temp_message_3 = concat(temp_message_2," on controller ");
   let temp_message_4 = concat(temp_message_3,to_string($message.Properties_Controller));
   let temp_message_5 = concat(temp_message_4,to_string($message.Properties_AssemblyName));
   set_field("NewTemplate", temp_message_5 );
end

```

Or

```auto
rule "RouteData"
when
  from_input("5e8c0edb50401d5943c76fcf") AND
  contains("Route matched with",to_string($message.message))
then
   let temp_message_0 = concat("Route matched with ",to_string($message.Properties_RouteData));
   let temp_message_1 = concat(temp_message_0," Executing controller action with signature ");
   let temp_message_2 = concat(temp_message_1,to_string($message.Properties_MethodInfo));
   let temp_message_3 = concat(temp_message_2," on controller ");
   let temp_message_4 = concat(temp_message_3,to_string($message.Properties_Controller));
   let temp_message_5 = concat(temp_message_4,to_string($message.Properties_AssemblyName));
   set_field("NewTemplate", temp_message_5 );
end

```

why `($message.Properties_RouteData)` in `when section` and our condition does not work?!  
thanks.

---

<div class="post-metadata">

**Author:** ![tmacgbay](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/tmacgbay/32/3878_2.png) [@tmacgbay](https://community.graylog.org/u/tmacgbay)\
**Post date:** [April 9, 2020, 5:21pm UTC](https://community.graylog.org/t/problem-with-when-section-in-pipeline/14902/2 "2020-04-09T17:21:22Z")

</div>

has\_field() is just the field in quotes:

`has_field("Properties_RouteData")`

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [April 23, 2020, 5:22pm UTC](https://community.graylog.org/t/problem-with-when-section-in-pipeline/14902/3 "2020-04-23T17:22:08Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.