Use custom field (created by inputs/extractors) for a pipeline filter?

Graylog Central (peer support)
1

Hi,
I just want to “ignore” some log messages. If you have better solutions, I will be also happy :wink:

My plan is:

  • use inputs/extractor to add a field “skip” (Store as field: skip)
  • use pipeline/filter to drop all messages with the field “skip”

The extractor look fine, but my messages are not dropped.

Thats I wrote as filter:

rule "skip"
when 
 has_field ("skip")
then 
 drop_message();
end

Is it not possible to use such a custum field for a filter? What can I do or is just my filter wrong?
At the moment, I just move them to a separated stream, but I want to ignore/delete them.

Thanks :wink:

2

Hej @qupfer

what is your configured processing order the pipelines need to be after the message filter chain …

3

Thanks…so simple :wink:

4

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.