# Tracking Print Jobs

**URL:** https://community.graylog.org/t/tracking-print-jobs/23138
**Category:** Miscellaneous
**Tags:** winlogbeat, windows, sidecar
**Created:** [March 23, 2022, 4:06pm UTC](https://community.graylog.org/t/tracking-print-jobs/23138 "2022-03-23T16:06:48Z")
**Posts on this page:** 1
**Showing post:** 2

<div class="post-metadata">

### Author: ![cdshow](https://avatars.discourse-cdn.com/v4/letter/c/c0e974/32.png) [@cdshow](https://community.graylog.org/u/cdshow)
#### Post date: [September 21, 2022, 6:27pm UTC](https://community.graylog.org/t/tracking-print-jobs/23138/2 "2022-09-21T18:27:29Z")

</div>

I have tried everything to get this pipeline to work and I can’t seem to get the rename/set field portion of this to work. The routing portion works but the setting field names doesn’t I have tried every combination I can think of, I had to change the $message.winlog\_event\_id to $message.winlogbeat\_event\_id but I can’t figure out how to make it work with the Paramaters, I have 2 different options I have tried in here for Param 3 & 8 and neither one work. I feel like I’ve almost gotten it but I can’t find any documentation about using the variable $message with specific fields.

```auto
----------

rule "Printer_Tracking"
when
    // Function converts generic fields names to useful ones
    // then removes the unhelpful fieldnames because we don't want them
    to_string($message.winlogbeat_event_id) == "307"
then
    // change fields to something that makes sense.
    set_field("print_user", $message.winlogbeat_winlog_user_data_Param3);
    set_field("printed_from", $message._winlog_user_data_Param4);
    set_field("printer_name", $message._winlog_user_data_Param5);
    set_field("printed_from_ip", $message._winlog_user_data_Param6);
    set_field("page_count", to_long($message.user_data_Param8));
    remove_field("winlogbeat_winlog_user_data_Param1"); // document number
    remove_field("winlog_user_data_Param2"); // action i.e. "Print Document"
    remove_field("winlog_user_data_Param3");
    remove_field("winlog_user_data_Param4");
    remove_field("winlog_user_data_Param5");
    remove_field("winlog_user_data_Param6");
    remove_field("winlog_user_data_Param7"); //size in bytes
    remove_field("winlog_user_data_Param8"); 
    remove_field("winlog_process_thread_id"); // who cares about the thread id? Not me. 
    remove_field("winlog_process_pid"); // who cares about the pid? Also Not me. 
    remove_field("winlog_opcode"); //  
    // Pull out for reporting
    route_to_stream("Printing_reports_stream");      

end
------------

```

Any thoughts/advice?

Moved to a dedicated thread.  
[Printer tracking pipeline - $message\_ field names not working for set or rename - Templates and Rules Exchange / Pipeline Rules - Graylog Community](https://community.graylog.org/t/printer-tracking-pipeline-message-field-names-not-working-for-set-or-rename/25847/8)

Long story short we had 2 problems, 1 we needed to remove the appending of winlogbeats from the input & 2 we had miss-named the stream Printer\_reports\_stream rather than Printing\_reports\_stream. Just for anyone else that attempts this dashboard.

---

_[View the full topic](https://community.graylog.org/t/tracking-print-jobs/23138)._