For example when I do this
when
to_string($message.testfield) == “test”
then
set_field(“test”,“test2”);
end
Would the == part work or does the value “test” have to be acquired by another to_string and another field in the message?
For example when I do this
when
to_string($message.testfield) == “test”
then
set_field(“test”,“test2”);
end
Would the == part work or does the value “test” have to be acquired by another to_string and another field in the message?
Your example to compare string field with another string should work OK with ==
If you want to compare 2 string fields, it’s necessary to use to_string in both:
to_string($message.src_ip) == to_string($message.dst_ip)
Anyway, it’s better to first check, if field exists:
has_field("mnemonic") AND to_string($message.mnemonic) == "FILECPY"
https://docs.graylog.org/en/3.2/pages/pipelines/rules.html#conditions
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.