I have some logs that send timestamps in their messages, which I cannot change. Hence I want to create a rule to catch and remove that. I have tried the following - unsuccessful so far (I have tried with “true” instead of the contains rule, too): rule "Remvove date" when contains(to_string($me…

Here are a few things I noticed: you can make the when portion more efficient by just checking to see if application_name equals mytimeapp rather than searching for it. You need to assign the results of your regex_replace() back onto the field you are interested in with set_field() rule "R…

Remove date from message

Graylog Central (peer support)

gsmith (GSmith) August 10, 2022, 4:28am 5

Hey,

Did a quick forum search on this, maybe this might help.

Replace or Trim from message field in pipeline rule

Topic		Replies	Views
Writing/Debugging/Troubleshooting Pipeline Rules in Graylog Graylog Central (peer support) pipeline-rules , dump-messagespl , debuggingpl	4	7522	November 29, 2017
Delete specific data from message field Graylog Central (peer support)	4	206	June 9, 2023
Pipeline rule to convert timestamp field and parse message json Graylog Central (peer support) pipeline-rules	10	157	April 17, 2024
Pipeline rule don`t replace value in a message Graylog Central (peer support) pipeline-rules	7	1038	February 16, 2022
Pipeline rule not working on rewrite of timestamp Graylog Central (peer support) pipeline-rules , route-to-streampl	6	1007	September 18, 2018

Remove date from message

Related Topics