# Variables in pipelines

**URL:** <https://community.graylog.org/t/variables-in-pipelines/16086>\
**Category:** Graylog Central (peer support)\
**Tags:** pipeline-rules\
**Created:** [June 26, 2020, 8:35am UTC](https://community.graylog.org/t/variables-in-pipelines/16086 "2020-06-26T08:35:41Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![h.sreekant](https://avatars.discourse-cdn.com/v4/letter/h/b5e925/32.png) [@h.sreekant](https://community.graylog.org/u/h.sreekant)\
**Post date:** [June 26, 2020, 8:35am UTC](https://community.graylog.org/t/variables-in-pipelines/16086/1 "2020-06-26T08:35:41Z")

</div>

Hi ,

I am new to graylog and i’ve a use case as i need to compare event logs and if the source ip is same for last 2 or 3 logs, i need to alert. Is it possible to do something in graylog pipelines? i’ve set stream/rules etc. But unable to find any functions matching this case.

Any help would be appreciable  
Thanks  
S

---

<div class="post-metadata">

**Author:** ![makarands](https://avatars.discourse-cdn.com/v4/letter/m/838e76/32.png) [@makarands](https://community.graylog.org/u/makarands)\
**Post date:** [June 26, 2020, 12:12pm UTC](https://community.graylog.org/t/variables-in-pipelines/16086/2 "2020-06-26T12:12:13Z")

</div>

@h.sreekant Comparing two fields can be done when you use the same data type, e.g. `to_string($message.src_ip) == to_string($message.dst_ip)` will compare the two strings and will become `true` on match. Comparing different data types evaluates to `false`.

You can also check pipeline rules documentation for more information.  
[https://docs.graylog.org/en/latest/pages/pipelines/rules.html](https://docs.graylog.org/en/latest/pages/pipelines/rules.html)

Hope this will helps you 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [July 10, 2020, 12:27pm UTC](https://community.graylog.org/t/variables-in-pipelines/16086/3 "2020-07-10T12:27:25Z")

</div>

Closed on July 10, 2020, 12:27pm UTC

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.