Set_fields Usage?

Graylog Central (peer support)
6

Looks like Graylog needs us to be more specific on the set_fields() Here is an example I found in another forum post that @shoothub put up:

rule "Cisco FirePower priority parsing"
when
  contains(to_string($message.message), "%FTD", true)
then
  set_fields(grok(pattern: "<%{NONNEGINT:syslog_pri:int}>", value: to_string($message.message), only_named_captures: true)); 
  let priority = expand_syslog_priority(to_long($message.syslog_pri));
  set_fields({facility: priority.facility, level: priority.level });
end

(If this is the answer, please mark it as so for future searchers!)

1 Like