Rename message in pipeline


(Azamat) #1

Hi everyone

I’m trying to rename a message inside of a field, I can successfully rename the field but not the message

rule “rename LogonType”
when
has_field(“LogonType”) AND contains(to_string($message.LogonType), “3”)
then
rename_field(“3”,“Network”);
end

Can you please help
Thank you!


(Megan) #2

The rename field function cannot used to change field content. You will likely want to use a lookup table for your purpose. Here is an example: https://twitter.com/eric_capuano/status/1006326493998407680 . You would create a lookup table that correlates type to definition and then the pipeline would lookup and assign that value to a new field. Alternatively, you can use “set_field” and haev a rule for every logontype value. If you set the field logon type in the actions it’ll overwrite the “3” so:

rule “rename LogonType”
when
has_field(“LogonType”) AND contains(to_string($message.LogonType), “3”)
then
set_field(“LogonType”,“Network”);
end


(Azamat) #3

Thank you so much for your reply:slightly_smiling_face:


(system) #4

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.