I have some logs that send timestamps in their messages, which I cannot change. Hence I want to create a rule to catch and remove that. I have tried the following - unsuccessful so far (I have tried with “true” instead of the contains rule, too): rule "Remvove date" when contains(to_string($me…

Here are a few things I noticed: you can make the when portion more efficient by just checking to see if application_name equals mytimeapp rather than searching for it. You need to assign the results of your regex_replace() back onto the field you are interested in with set_field() rule "R…

Remove date from message

Graylog Central (peer support)

gsmith (GSmith) August 10, 2022, 4:28am 5

Hey,

Did a quick forum search on this, maybe this might help.

Replace or Trim from message field in pipeline rule

Topic		Replies	Views
Delete specific data from message field Graylog Central (peer support)	4	389	June 9, 2023
Replace or Trim from message field in pipeline rule Graylog Central (peer support) pipeline-rules	3	5297	September 27, 2019
Match Message Against a timestamp RegEx Graylog Central (peer support) pipeline-rules	4	1444	August 19, 2021
Replace string in field with pipeline rule Graylog Central (peer support) pipeline-rules	9	7080	April 26, 2019
Pipeline remove ip in message Graylog Central (peer support) pipeline-rules , debuggingpl	8	691	December 22, 2020

Remove date from message

Related topics