I have some logs that send timestamps in their messages, which I cannot change. Hence I want to create a rule to catch and remove that. I have tried the following - unsuccessful so far (I have tried with “true” instead of the contains rule, too): rule "Remvove date" when contains(to_string($me…

Here are a few things I noticed: you can make the when portion more efficient by just checking to see if application_name equals mytimeapp rather than searching for it. You need to assign the results of your regex_replace() back onto the field you are interested in with set_field() rule "R…

Remove date from message

Graylog Central (peer support)

gsmith (GSmith) August 10, 2022, 4:28am 5

Hey,

Did a quick forum search on this, maybe this might help.

Replace or Trim from message field in pipeline rule

Topic		Replies	Views
Match Message Against a timestamp RegEx Graylog Central (peer support) pipeline-rules	4	1377	August 19, 2021
Writing/Debugging/Troubleshooting Pipeline Rules in Graylog Graylog Central (peer support) pipeline-rules , dump-messagespl , debuggingpl	4	7919	November 29, 2017
Parse date from string in pipeline rule Graylog Central (peer support) pipeline-rules , docker	3	1375	May 30, 2023
Delete specific data from message field Graylog Central (peer support)	4	294	June 9, 2023
Pipeline rule to convert timestamp field and parse message json Graylog Central (peer support) pipeline-rules	10	429	April 17, 2024

Remove date from message

Related topics