Hi, I am currently testing custom plugins for message correlation. I know I
can send new messages via some of the OUTPUT plugins, but sometimes I would
like to generate a new message while the orginal message is still in
processing.
Eg. I have an INPUT or FILTER plugin and depending on the input attributes
of the message I would like to create a new message with some other
attributes without changing the original message, like this:
// pseudo-code
// import org.graylog2.plugin.Message;
// org.graylog2.plugin.Message msg;
if(msg.getField("myKey").toString() == "someSpecificValue")
{
Message msgNew = new Message();
msgNew.addField("source", "someSource");
// add other fields as necessary
msgNew.send();
}
If this is not possible how would/could this be achieved?
- thanks for your help!
--
You received this message because you are subscribed to the Google Groups
"graylog2" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
