I know we can reference $message in a rule but is it possible to use full_message instead, the reason being that after stripping the fields in a Windows log message all what is left is a small header, so rules are not able to correctly be evaluated. the rule I’m trying is: rule "Drop" when true …

@Alper , Thanks for your question! Our community members will be able to help you with responses from their experience in Graylog. I’ll start the responses with my take on your issue. I believe you can write a rule that uses the full_message instead of referencing a specific field. Here’s a conc…

[image] dscryber: drop_message(to_string(to_json(full_message))); From the community: [image] How can i extract json from full_message Graylog Central (peer support) Hi, I would like to parse a json which is in the full_message: 2020-02-21 07:40:26.725 INFO n/a […

So $message alone means the whole message, in your example you would reference full_message with $message.full_message or just replace anything after the dot with the field name you are wanting to target. Its done this way because you can technically be working on multiple copies of messages at onc…

Use full_message in a pipeline rule

Graylog Central (peer support)

dscryber (David Sciuto) February 10, 2023, 4:08pm 3

From the community:

Topic		Replies	Views
How can i extract json from full_message Graylog Central (peer support)	2	2862	February 24, 2020
Using Pipeline to drop messages Graylog Central (peer support)	3	2281	June 16, 2021
Pipeline Rule doesn't see extracted fields but only a few $message properties like $message.message and $message.level Graylog Central (peer support) pipeline-rules , debuggingpl	3	2350	November 15, 2017
Contains and Drop all other messages Graylog Central (peer support) pipeline-rules	7	3649	October 28, 2019
Remove or nullify full_message field after extractors are completed? Graylog Central (peer support)	1	720	November 12, 2021

Use full_message in a pipeline rule

Related topics