Hi Folks,
I have created graylog pipeline and using it as decorator. I need to extract a field value or the entire field.
The pipeline rule
I don’t see the new update_failure reason field after i apply the decorator. Also, you can see how the original failure reason appears.
regarding to the docs of the regex function ( http://docs.graylog.org/en/2.4/pages/pipelines/functions.html#regex ) you would need to access the result with update_failurereason[0].
Match the regular expression in pattern against value. Returns a match object, with the boolean property matches to indicate whether the regular expression matched and, if requested, the matching groups as groups. The groups can optionally be named using the group_names array. If not named, the groups names are strings starting with “0”.
Hi Jan,
So I change update_failurereason to update_failurereason[0] in above rule and that would work?
as the selected group via regex need to be a string it should be update_failurereason["0"] pardon my mistake.
Jan
pardon me for my ignorance, Does this look right?
rule "function UpdateFailureReason"
when
has_field(“FailureReason”)
then
let update_failurereason = regex(“Failure Reason:\s+(>?([^\s].*)$)”, to_string($message.full_message));
set_field(“FailureReasonUpdated”,update_failurereason[“0”]);
end
I still don’t see a new field called FailureReasonUpdated with results from regex function.
did you checked if your regex works on the input from the field?
I am using the same regex with extractor and it works. However in this case i modified the keyword from Logon Type to Failure Reason.
Hi Jan, wondering if you see any issues with the rule? it doesn’t seem to work on my end.
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.
