Questions regarding pipeline processing / change field value of message

Graylog Central (peer support)
1

Hi
i try to rewrite the source field from a non-standard syslog message from a switch. It has the field “sourcefqdn” which contains the value (=the hostname of device) I want as value for the “source” field. Right now, in the source field there is the ip address of the device. Input is syslog (udp).

I set up a pipeline with one stage. this stage contains the following rule:

    rule "switch_rewrite"
when
    has_field("sourcefqdn") && to_string($message.sourcefqdn) == to_string(switch.example.com)
then
    set_field("source", to_string("$message.sourcefqdn"));
end

I read up on message processing order and set the message processor configuration to let the Pipeline Processor run AFTER the Message Filter Chain, as I want all messages from the All Messages Stream to be processed.

But new messages from this device will still show up with their IP-Address as source as if they won’t get processed.

Therfore my questions are:

  • Is this the correct way to do alter stuff in messages, e. g. rewriting hostnames?
  • Is the order correct or didn’t I grasp the concept of stream processing?
  • Is my rule code correct?
  • Is it possible to check if the rule matches a certain message? E.g. not creating a message in the simulator but using one from the acutal stream? I can’t figure out how to add the field “sourcefqdn” in the simulator …

Any help & hints are much appreciated!

2

The double quotes are wrong.

Try the following rule:

rule "switch_rewrite"
when
    has_field("sourcefqdn") && to_string($message.sourcefqdn) == "switch.example.com"
then
    set_field("source", to_string($message.sourcefqdn));
end
3

It worked! Thank you very much for the quick answer!

4

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.