Setting Field Value in Event Definitions Using Regular Expressions

Graylog Central (peer support)
1

Hi,

I am using Graylog v3.2 and would like to enrich event notification with fields extracted from the original message. Assuming this could be done via Template option that used JMTE syntax, how is it possible to set a value using regular expressions? Official documentation has no examples nor does the JMTE syntax reference.

For example. ${source.messge} contains a string "custom_string='123'". To extract the value of custom_string we could use regex /custom_string='(.*)'/ and then select the second matching group.

Is this possible using the Template? Or there is a better way of doing it?

Thank you.

2

I would handle that in a pipeline rule so it was already set up and stored in the stream/elastic before I get to the event notification.

1 Like
3

Thank you, will try that.

4

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.