Hi Jeff,
the next version of the message pipeline processor will contain functions
to handle syslog priorities and levels (e. g. convert them to a
string): https://github.com/Graylog2/graylog-plugin-pipeline-processor/pull/19
For now, there's no other way than creating 7 separate rules, one for each
syslog level.
Cheers,
Jochen
On Tuesday, 24 May 2016 18:44:19 UTC+2, Jeff R wrote:
>
> My goal is to change all my syslog "Level" field entries from only a digit
> (eg. 0-7) into their human readable form (Error,critical, etc). I want to
> avoid making 7 separate rules to do this but am unsure how to make the
> below a catch all statement.
>
> //This is my current rule
> rule "Syslog Test"
>
> when
> to_string($message.level)=="6"
> then
> set_field("Priority_Level", "Informational");
> end
>
> //This is one I am thinking would work somehow?
> rule "Syslog Test2"
>
> when
> has_field("level")
> then
> ????
> end
>
--
You received this message because you are subscribed to the Google Groups
"Graylog Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/graylog2/770f3a3f-c8fa-444f-afcf-12a074bf6d3c%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.
