I know we can reference $message in a rule but is it possible to use full_message instead, the reason being that after stripping the fields in a Windows log message all what is left is a small header, so rules are not able to correctly be evaluated. the rule I’m trying is: rule "Drop" when true …

Use full_message in a pipeline rule

dscryber (David Sciuto) February 10, 2023, 4:08pm 3

From the community:

Topic		Replies	Views
Dropping messages using Pipelines Graylog Central (peer support) pipeline-rules , debuggingpl	4	7315	August 2, 2019
Drop message before "All Messages" stream Graylog Central (peer support) pipeline-rules , route-to-streampl	3	1768	April 7, 2020
I want to drop message when the message contains multi keyword Graylog Central (peer support) pipeline-rules	5	730	February 23, 2023
Using Pipeline to drop messages Graylog Central (peer support)	4	2136	June 30, 2021
Pipeline Drop Message Not Working Graylog Central (peer support)	14	1409	February 1, 2023