Set the fieldname of the set_field function from another function

(Hazmes) #1


I am currently trying something like this:

rule "extract analysed or failed requests"
    has_field("message") AND regex("(\\w*\\sRequests):\\s(\\d*)",to_string($message.message)).matches == true
    let m = regex("(\\w*\\sRequests):\\s(\\d*)",to_string($message.message));

And I want to match a message like this

Failed Requests: 0

This does not work currently, however if I set the field name in the set_field function to an actual string it works.

Is my code wrong or does the function set_field not support field names from anything but a literal string?
If yes, how can I do it then?

(Jochen) #2

Field names always have to be strings.

(system) #3

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.