Unable to Drop syslog messages based on message contents

[gsmith]

Hello,

Have you tried.

contains(to_string($message.msg), "DUPLEX_MISMATCH") 

By chance is that a custom field “message.msg”?

Have you seen this post?

Pipeline Rule - Drop messages with field containing IP

you can use the debug() function and watch what it’s output is in the Graylog logs: tail -f /var/log/graylog-server/server.log rule "Drop NAT from specific Subnet" when starts_with(to_string($message.Int_Src_IP), "172.16.40") then debug("Source IP match:"); debug(to_string($message.Int_Src_IP)); drop_message(); end if nothing shows you can change the when to has_field("Int_Src_IP") just to make sure you get to the debug Debug Function - Graylog 4.0