Set the fieldname of the set_field function from another function

Graylog Central (peer support)
1

Hi,

I am currently trying something like this:

rule "extract analysed or failed requests"
When
    has_field("message") AND regex("(\\w*\\sRequests):\\s(\\d*)",to_string($message.message)).matches == true
then
    let m = regex("(\\w*\\sRequests):\\s(\\d*)",to_string($message.message));
    set_field(to_string(m["0"]),to_string(m["1"]));
end

And I want to match a message like this

Failed Requests: 0

This does not work currently, however if I set the field name in the set_field function to an actual string it works.

Is my code wrong or does the function set_field not support field names from anything but a literal string?
If yes, how can I do it then?

2

Field names always have to be strings.

3

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.