when i study on how to make a pipeline, i am confused with the data type supported by graylog, for example, as the statements for function regex:
regex(pattern: string, value: string, [group_names: array[string])
…Returns a match object, with the boolean property matches to indicate whether the regular expression matched…
but search in forum, they are writing in the following way:
rule “a rule desc”
regex(“the-pattern”, to_string($message.message)).matches == true
firstly the $message.message in ES was a text data type which was a data type of string, why we need a type conversion by the function to_string ?
secondly now that the return value of regex(…).matches already a boolean data type, why we need an additional “== true” or to_bool data type conversion？