Stream : stop stage after matching a rule

Graylog Central (peer support)
1

Hello!

Does anyone know if it’s possible to exit a stage after a rule matches?
If a message matches a rule, I don’t want the following rules in the same stage to be evaluated.

Thanks for your help!

2

I think you can set the pipeline stage to “match all rules” and create a rule that is not matched by your logs, so it will stop the pipeline at this stage.

Please add some examples of your logs and pipeline if you need more help.

3

I see what you mean, but that implies the next stages won’t be applied, right?
My goal is to parse Cisco logs:

  • Stage 1: Check if it’s a Cisco log

  • Stage 2:

    • Apply rule 1 if it concerns link events

    • Apply rule 2 if it concerns RADIUS

    • etc.

  • Stage 3: Route the message to the Cisco IOS stream

Is this the right way to do it?

4

Yes with “match all rules” the next stages won’t be applied if one rule doesn’t match. If you want to route all logs with Stage 3 except some logs just add a condition on Stage 3 to filter logs.

Yes it’s the right way to parse logs.

1 Like
5

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.