I know we can reference $message in a rule but is it possible to use full_message instead, the reason being that after stripping the fields in a Windows log message all what is left is a small header, so rules are not able to correctly be evaluated. the rule I’m trying is: rule "Drop" when true …

Use full_message in a pipeline rule

dscryber (David Sciuto) February 10, 2023, 4:08pm 3

From the community:

Topic		Replies	Views
How can i extract json from full_message Graylog Central (peer support)	3	2821	March 9, 2020
Using Pipeline to drop messages Graylog Central (peer support)	4	2192	June 30, 2021
Pipeline Rule doesn't see extracted fields but only a few $message properties like $message.message and $message.level Graylog Central (peer support) pipeline-rules , debuggingpl	4	2330	November 29, 2017
Contains and Drop all other messages Graylog Central (peer support) pipeline-rules	8	3572	November 11, 2019
Remove or nullify full_message field after extractors are completed? Graylog Central (peer support)	2	662	November 26, 2021