# Unable to Drop syslog messages based on message contents **URL:** \ **Category:** Graylog Central (peer support)\ **Created:** [August 11, 2022, 12:01am UTC](https://community.graylog.org/t/unable-to-drop-syslog-messages-based-on-message-contents/25242 "2022-08-11T00:01:32Z")\ **Posts on this page:** 13\ **Page:** 1
**Author:** ![daniel.lang](https://avatars.discourse-cdn.com/v4/letter/d/ecb155/32.png) [@daniel.lang](https://community.graylog.org/u/daniel.lang)\ **Post date:** [August 11, 2022, 12:01am UTC](https://community.graylog.org/t/unable-to-drop-syslog-messages-based-on-message-contents/25242/1 "2022-08-11T00:01:32Z")
HI All, I am encountering an issue with pipeline configuration where I seem to be unable to drop Syslog messages based on the message contents. I have done some googling / searching of the forum and the other suggestions don’t seem to be helping. I am running Graylog 4.1.14-1 on Ubuntu 22.04.1 LTS An example of the message type I am trying to drop is below: `%CDP-4-DUPLEX_MISMATCH: duplex mismatch discovered on GigabitEthernet1/0/32 (not half duplex), with -Device Name- GigabitEthernet0 (half duplex).` I have created a new pipeline and attached it to the all messages stream with the following rule attached. to the Stage 0 section of the pipeline ```auto rule "Drop CDP Duplex Noise" when contains(to_string($message.msg), "duplex mismatch") then drop_message(); end ``` Under the Message processor configuration, I have the default pipeline processor then the message filter chain. I did try reordering them but didn’t have any luck with that. ---
**Author:** ![gsmith](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gsmith/32/1222_2.png) [@gsmith](https://community.graylog.org/u/gsmith)\ **Post date:** [August 12, 2022, 1:47am UTC](https://community.graylog.org/t/unable-to-drop-syslog-messages-based-on-message-contents/25242/2 "2022-08-12T01:47:05Z")
Hello, Have you tried. ```auto contains(to_string($message.msg), "DUPLEX_MISMATCH") ``` By chance is that a custom field “message.msg”? Have you seen this post? > [@Pipeline Rule - Drop messages with field containing IP](https://community.graylog.org/t/pipeline-rule-drop-messages-with-field-containing-ip/19065/4): > > you can use the debug() function and watch what it’s output is in the Graylog logs: tail -f /var/log/graylog-server/server.log rule "Drop NAT from specific Subnet" when starts\_with(to\_string($message.Int\_Src\_IP), "172.16.40") then debug("Source IP match:"); debug(to\_string($message.Int\_Src\_IP)); drop\_message(); end if nothing shows you can change the when to has\_field("Int\_Src\_IP") just to make sure you get to the debug [Debug Function - Graylog 4.0](https://docs.graylog.org/en/4.0/pages/pipelines/functions.html#debug) ---
**Author:** ![daniel.lang](https://avatars.discourse-cdn.com/v4/letter/d/ecb155/32.png) [@daniel.lang](https://community.graylog.org/u/daniel.lang)\ **Post date:** [August 12, 2022, 2:06am UTC](https://community.graylog.org/t/unable-to-drop-syslog-messages-based-on-message-contents/25242/3 "2022-08-12T02:06:20Z")
Hi, Thanks for the response. I have tried a number of different combinations and interestingly I have created another pipeline rule that actually works as intended This rule drops the SpamAPTask messages from our WLC’s rule “Drop SpamApTask” when contains(to\_string($message.message), “spamApTask”) then drop\_message(); end But the CDP Mismatch error still doesn’t get dropped. I have updated the rule as per below but still doesn’t seem to be having the desired effect. rule “Drop CDP Duplex Noise” when contains(to\_string($message.message), “DUPLEX\_MISMATCH”) then drop\_message(); end ---
**Author:** ![gsmith](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gsmith/32/1222_2.png) [@gsmith](https://community.graylog.org/u/gsmith)\ **Post date:** [August 12, 2022, 2:18am UTC](https://community.graylog.org/t/unable-to-drop-syslog-messages-based-on-message-contents/25242/4 "2022-08-12T02:18:26Z")
I see, have you tried the debug() in the rule? ---
**Author:** ![daniel.lang](https://avatars.discourse-cdn.com/v4/letter/d/ecb155/32.png) [@daniel.lang](https://community.graylog.org/u/daniel.lang)\ **Post date:** [August 12, 2022, 2:34am UTC](https://community.graylog.org/t/unable-to-drop-syslog-messages-based-on-message-contents/25242/5 "2022-08-12T02:34:35Z")
Thanks for the tip around the debug function. I wrapped the debug around the drop\_message function and I get the following output in the log. 2022-08-12T12:33:13.065+10:00 INFO [Function] PIPELINE DEBUG: Passed value is NULL. 2022-08-12T12:33:13.066+10:00 INFO [Function] PIPELINE DEBUG: Passed value is NULL. 2022-08-12T12:33:13.360+10:00 INFO [Function] PIPELINE DEBUG: Passed value is NULL. 2022-08-12T12:33:14.066+10:00 INFO [Function] PIPELINE DEBUG: Passed value is NULL. 2022-08-12T12:33:15.076+10:00 INFO [Function] PIPELINE DEBUG: Passed value is NULL. 2022-08-12T12:33:15.874+10:00 INFO [Function] PIPELINE DEBUG: Passed value is NULL. 2022-08-12T12:33:16.743+10:00 INFO [Function] PIPELINE DEBUG: Passed value is NULL. ---
**Author:** ![gsmith](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gsmith/32/1222_2.png) [@gsmith](https://community.graylog.org/u/gsmith)\ **Post date:** [August 12, 2022, 2:36am UTC](https://community.graylog.org/t/unable-to-drop-syslog-messages-based-on-message-contents/25242/6 "2022-08-12T02:36:41Z")
I see, so its not even grabbing it. Wonder if its because it looks like this _%CDP-4-DUPLEX\_MISMATCH_ ---
**Author:** ![daniel.lang](https://avatars.discourse-cdn.com/v4/letter/d/ecb155/32.png) [@daniel.lang](https://community.graylog.org/u/daniel.lang)\ **Post date:** [August 12, 2022, 2:39am UTC](https://community.graylog.org/t/unable-to-drop-syslog-messages-based-on-message-contents/25242/7 "2022-08-12T02:39:39Z")
I just tried updating the message with the full message value and I get the same result in the log file. Would I need to escape out the %? ---
**Author:** ![gsmith](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gsmith/32/1222_2.png) [@gsmith](https://community.graylog.org/u/gsmith)\ **Post date:** [August 12, 2022, 2:48am UTC](https://community.graylog.org/t/unable-to-drop-syslog-messages-based-on-message-contents/25242/8 "2022-08-12T02:48:20Z")
I think so, and double escape it `\\`. Doesn’t hurt to try. Been think about this, I’m wonder if maybe regex to grab that unique string then drop it. Just an idea, I haven’t done it yet. EDIT: I don’t have time tonight to lab this out but if @tmacgbay is around he may have an idea. If not I’ll be able to help more tomorrow ---
**Author:** ![tmacgbay](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/tmacgbay/32/3878_2.png) [@tmacgbay](https://community.graylog.org/u/tmacgbay)\ **Post date:** [August 12, 2022, 3:51pm UTC](https://community.graylog.org/t/unable-to-drop-syslog-messages-based-on-message-contents/25242/9 "2022-08-12T15:51:09Z")
> [@daniel.lang](#): > > `$message.msg` I think you want `$message.message` here because you are checking to see if the entire message has an instance of `"duplex mismatch"` ```auto rule "Drop CDP Duplex Noise" when contains(to_string($message.message), "duplex mismatch") then drop_message(); end ``` ---
**Author:** ![daniel.lang](https://avatars.discourse-cdn.com/v4/letter/d/ecb155/32.png) [@daniel.lang](https://community.graylog.org/u/daniel.lang)\ **Post date:** [August 14, 2022, 11:28pm UTC](https://community.graylog.org/t/unable-to-drop-syslog-messages-based-on-message-contents/25242/10 "2022-08-14T23:28:55Z")
Thanks for the reply, I have changed it to $message.message and still having issues dropping the messages. ---
**Author:** ![tmacgbay](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/tmacgbay/32/3878_2.png) [@tmacgbay](https://community.graylog.org/u/tmacgbay)\ **Post date:** [August 15, 2022, 3:30pm UTC](https://community.graylog.org/t/unable-to-drop-syslog-messages-based-on-message-contents/25242/11 "2022-08-15T15:30:12Z")
Try: ```auto rule "Drop CDP Duplex Noise" when contains(to_string($message.message), "duplex mismatch") then // use $ tail -f /var/log/graylog-server/server.log to watch for the results of the below debug message // debug("_*_*_* - Drop Message rule was hit."); drop_message(); end ``` If the debug statement doesn’t appear in your server log then “duplex mismatch” is not being found in the message… check to make sure the pipeline is attached to the correct stream and if it is, are there other pipelines attached to the stream or other rules/stages that run before this one? ---
**Author:** ![daniel.lang](https://avatars.discourse-cdn.com/v4/letter/d/ecb155/32.png) [@daniel.lang](https://community.graylog.org/u/daniel.lang)\ **Post date:** [August 21, 2022, 11:41pm UTC](https://community.graylog.org/t/unable-to-drop-syslog-messages-based-on-message-contents/25242/12 "2022-08-21T23:41:31Z")
Hi All, Just wanted to come back and say I had resolved the issue. It appears for whatever reason the rule was just broken, deleting and recreating it seemed to of resolved the issue. Thanks for all your assistance, its been much appreciated. ---
**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\ **Post date:** [September 4, 2022, 11:41pm UTC](https://community.graylog.org/t/unable-to-drop-syslog-messages-based-on-message-contents/25242/13 "2022-09-04T23:41:48Z")
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.