Did come out with this:
rule "Add ID Meaning"
> when
> has_field("ID") && contains(to_string($message.ID), "11")
> then
> set_field("ID_Description", "A lease was renewed by a client.");
> end
Can I have multiple when/then clauses in the same rule?
--
You received this message because you are subscribed to the Google Groups
"Graylog Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/graylog2/5fc60775-324a-4d5a-a435-3bf9fc5ecd3a%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.
