We have real-time events containing ‘public ip addresses’ coming into the All message Streams . Now , i wanted to create a new stream with a condition saying only if the messages contain public ip addresses in them , please route them into a different stream to apply some pipeline rules .
I have created a Grok Pattern to identify the public IP’s in the messages and has also created a new field dedicated to only public IP’s like shown here
Need a idea on how to map them in the stream rules ??