# Rule does not work as expected

**URL:** <https://community.graylog.org/t/rule-does-not-work-as-expected/1583>\
**Category:** Graylog Central (peer support)\
**Created:** [June 28, 2017, 12:03pm UTC](https://community.graylog.org/t/rule-does-not-work-as-expected/1583 "2017-06-28T12:03:25Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![schurd](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/schurd/32/1068_2.png) [@schurd](https://community.graylog.org/u/schurd)\
**Post date:** [June 28, 2017, 12:03pm UTC](https://community.graylog.org/t/rule-does-not-work-as-expected/1583/1 "2017-06-28T12:03:25Z")

</div>

Hello All,

following rule should just drop the message if the log level is “7”:

```auto
rule "drop_level7_netscaler"
when
    syslog_level($message.level) == "7"
then
    drop_message();
end

```

Somehow this does not work.  
Yes, the rule is part of a pipeline, which is attached to a stream.  
I use Graylog 2.2.3.  
The pipeline processor is active.

Thanks in advance for any help.

Best regards,

Dietmar Schur

---

<div class="post-metadata">

**Author:** ![maniel](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/maniel/32/58_2.png) [@maniel](https://community.graylog.org/u/maniel)\
**Post date:** [June 28, 2017, 12:23pm UTC](https://community.graylog.org/t/rule-does-not-work-as-expected/1583/2 "2017-06-28T12:23:53Z")

</div>

is the message level field set by extractor? if so, then you have to change message processors order in `System / Configurations` and move the `Pipeline Processor` to the end, after `Message Filter Chain`

---

<div class="post-metadata">

**Author:** ![schurd](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/schurd/32/1068_2.png) [@schurd](https://community.graylog.org/u/schurd)\
**Post date:** [June 28, 2017, 12:31pm UTC](https://community.graylog.org/t/rule-does-not-work-as-expected/1583/3 "2017-06-28T12:31:24Z")

</div>

Hallo Maniel,

thanks for the quick reply.

Yes, if I swtich the order in  
**_Message Processors Configuration_**  
to:  
1 GeoIP Resolver disabled  
2 Message Filter Chain active  
3 Pipeline Processor active

Then I get some throughput in the puipeline. This was always 0 before this change.  
Before, the **Pipeline Processor** was second (2).

But in the respective stream I see lots of messages which should be dropped by the rule.  
What is here missing?

What does drop\_message() do? Does it really drop the message from all streams, once and for ever?

Best regards,

Dietmar Schurr

---

<div class="post-metadata">

**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\
**Post date:** [June 28, 2017, 12:33pm UTC](https://community.graylog.org/t/rule-does-not-work-as-expected/1583/4 "2017-06-28T12:33:17Z")

</div>

The [`syslog_level()`](http://docs.graylog.org/en/2.2/pages/pipelines/functions.html#syslog-level) function converts the syslog severity number into its string representation, so `syslog_level(7)` will yield `"Debug"`.

You could simply check the value of `$message.level` instead of using the `syslog_level()` function.

---

<div class="post-metadata">

**Author:** ![schurd](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/schurd/32/1068_2.png) [@schurd](https://community.graylog.org/u/schurd)\
**Post date:** [June 28, 2017, 12:44pm UTC](https://community.graylog.org/t/rule-does-not-work-as-expected/1583/5 "2017-06-28T12:44:16Z")

</div>

Hello Jochen,  
thank you very much. The problem is solved.  
The working rule is:

```
rule "drop_level7_netscaler"
when
    to_string($message.level) == "7"
then
    drop_message();
end

```

Also I needed to switch the Messages Processor Configuration.

Now the Stream gets no more level 7 messages.

Great 🙂

Best regards,  
Dietmar Schurr

---

<div class="post-metadata">

**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\
**Post date:** [June 28, 2017, 1:04pm UTC](https://community.graylog.org/t/rule-does-not-work-as-expected/1583/6 "2017-06-28T13:04:16Z")

</div>

And even the `to_string()` method is not necessary if you compare to the _numeric_ value.

---

<div class="post-metadata">

**Author:** ![schurd](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/schurd/32/1068_2.png) [@schurd](https://community.graylog.org/u/schurd)\
**Post date:** [June 28, 2017, 1:16pm UTC](https://community.graylog.org/t/rule-does-not-work-as-expected/1583/7 "2017-06-28T13:16:33Z")

</div>

Hello Jooochen,

but

```
rule "drop_level7_netscaler"
when
    $message.level == 7
then
    drop_message();
end

```

does not work. The messages are not dropped.

Regards,

Dietmar

---

<div class="post-metadata">

**Author:** ![schurd](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/schurd/32/1068_2.png) [@schurd](https://community.graylog.org/u/schurd)\
**Post date:** [June 28, 2017, 1:23pm UTC](https://community.graylog.org/t/rule-does-not-work-as-expected/1583/8 "2017-06-28T13:23:51Z")

</div>

Hello,

the rule:

```
rule "drop_level7_netscaler"
when
    to_long($message.level) > 5
then
    drop_message();
end

```

works well and filters all messages with level higher than 5.

Regards,

Dietmar

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [July 12, 2017, 1:24pm UTC](https://community.graylog.org/t/rule-does-not-work-as-expected/1583/9 "2017-07-12T13:24:18Z")

</div>

Closed on July 12, 2017, 1:24pm UTC

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.