My goal is to change all my syslog "Level" field entries from only a digit
(eg. 0-7) into their human readable form (Error,critical, etc). I want to
avoid making 7 separate rules to do this but am unsure how to make the
below a catch all statement.
//This is my current rule
rule "Syslog Test"
when
to_string($message.level)=="6"
then
set_field("Priority_Level", "Informational");
end
//This is one I am thinking would work somehow?
rule "Syslog Test2"
when
has_field("level")
then
????
end
--
You received this message because you are subscribed to the Google Groups
"Graylog Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/graylog2/3a46573d-cb30-4c26-be9d-216014b944d5%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.
