Hi All,
I am trying to write a pipeline rule in which I’ve to check if a field exists with a particular regex pattern. Is there any way I can do it? Usually, we use has_field() if when we know the exact key. In this case, we don’t. For e.g. I’ve to filter all the messages which have one of the following fields:
filesystem.asd
filesystem.add
filesystem.wer
I need to write something like:
rule “filesystem_new”
when
has_field(“filesystem.*”)
Please let me know how can this be done.