Note: Using Graylog 3.0.2+1686930
Basically, a CEF log message includes (among others) two values, in and out, to represent the byte count in both directions. All I want is to add a new column to a table widget in Views that displays the following metrics:
The latter I have issues with.
After much reading and testing, I went the path of Pipelines and created a Pipeline rule that will read in and out and add them together, believing the set_field would allow me to create a new field (d’oh).
For illustration, here is the Pipeline rule:
rule "get_total_bytes" when has_field("in") && has_field("out") then let total = to_double($message.in) + to_double($message.out); set_field("total_bytes",total); end
Tried using extractors, but the log has been appropriately extracted by the CEF decoder. Since the value I want is not within the log structure and I would prefer not to alter any other message field, I cannot see how extractors would help.
So, any ideas on how to display “sum(in)+sum(out)” in a Views Widget?