Hi everyone
I’m trying to rename a message inside of a field, I can successfully rename the field but not the message
rule “rename LogonType”
when
has_field(“LogonType”) AND contains(to_string($message.LogonType), “3”)
then
rename_field(“3”,“Network”);
end
Can you please help
Thank you!
The rename field function cannot used to change field content. You will likely want to use a lookup table for your purpose. Here is an example: https://twitter.com/eric_capuano/status/1006326493998407680 . You would create a lookup table that correlates type to definition and then the pipeline would lookup and assign that value to a new field. Alternatively, you can use “set_field” and haev a rule for every logontype value. If you set the field logon type in the actions it’ll overwrite the “3” so:
rule “rename LogonType”
when
has_field(“LogonType”) AND contains(to_string($message.LogonType), “3”)
then
set_field(“LogonType”,“Network”);
end
Thank you so much for your reply:slightly_smiling_face:
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.
