When Condition comparing against string

[calamity]

For example when I do this

when
to_string($message.testfield) == “test”
then
set_field(“test”,“test2”);
end

Would the == part work or does the value “test” have to be acquired by another to_string and another field in the message?

[shoothub]

Your example to compare string field with another string should work OK with ==
If you want to compare 2 string fields, it’s necessary to use to_string in both:
to_string($message.src_ip) == to_string($message.dst_ip)

Anyway, it’s better to first check, if field exists:
has_field("mnemonic") AND to_string($message.mnemonic) == "FILECPY"

https://docs.graylog.org/en/3.2/pages/pipelines/rules.html#conditions