Well, adding a "when" does certainly help, My bad! rule "blacklist" when contains(to_string($message.message), "systemd") then drop_message(); end
On Thursday, January 5, 2017 at 4:29:48 PM UTC+1, Frank wrote: > > Hi there, > > I'm just making my first steps with processing pipelines, and want to > create a rule that blacklists / drops certain messages. > I'm trying to add a rule that looks like this: > > rule "blacklist" > contains(to_string($message), "systemd") > then > drop_message($message) > end > > > When I click "Save" nothing happens and in server.log this appears: > > 2017-01-05T15:24:22.091Z ERROR [PipelineRuleParser] Unable to retrieve > expression for variable contains, this is a bug > 2017-01-05T15:24:22.093Z ERROR [AnyExceptionClassMapper] Unhandled > exception in REST resource > java.lang.NullPointerException > at > org.graylog.plugins.pipelineprocessor.parser.PipelineRuleParser$RuleTypeChecker.exitMessageRef(PipelineRuleParser.java:677) > > ~[?:?] > at > org.graylog.plugins.pipelineprocessor.parser.RuleLangParser$MessageRefContext.exitRule(RuleLangParser.java:672) > > ~[?:?] > at > org.antlr.v4.runtime.tree.ParseTreeWalker.exitRule(ParseTreeWalker.java:71) > ~[?:?] > at org.antlr.v4.runtime.tree.ParseTreeWalker.walk(ParseTreeWalker.java:54) > ~[?:?] > at org.antlr.v4.runtime.tree.ParseTreeWalker.walk(ParseTreeWalker.java:52) > ~[?:?] > at org.antlr.v4.runtime.tree.ParseTreeWalker.walk(ParseTreeWalker.java:52) > ~[?:?] > at org.antlr.v4.runtime.tree.ParseTreeWalker.walk(ParseTreeWalker.java:52) > ~[?:?] > at org.antlr.v4.runtime.tree.ParseTreeWalker.walk(ParseTreeWalker.java:52) > ~[?:?] > at > org.graylog.plugins.pipelineprocessor.parser.PipelineRuleParser.parseRule(PipelineRuleParser.java:136) > > ~[?:?] > at > org.graylog.plugins.pipelineprocessor.rest.RuleResource.createFromParser(RuleResource.java:93) > > ~[?:?] > at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) > ~[?:1.8.0_111] > at > sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) > ~[?:1.8.0_111] > at > sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) > > ~[?:1.8.0_111] > at java.lang.reflect.Method.invoke(Method.java:498) ~[?:1.8.0_111] > at > org.glassfish.jersey.server.model.internal.ResourceMethodInvocationHandlerFactory$1.invoke(ResourceMethodInvocationHandlerFactory.java:81) > > ~[graylog.jar:?] > at > org.glassfish.jersey.server.model.internal.AbstractJavaResourceMethodDispatcher$1.run(AbstractJavaResourceMethodDispatcher.java:144) > > ~[graylog.jar:?] > at > org.glassfish.jersey.server.model.internal.AbstractJavaResourceMethodDispatcher.invoke(AbstractJavaResourceMethodDispatcher.java:161) > > ~[graylog.jar:?] > at > org.glassfish.jersey.server.model.internal.JavaResourceMethodDispatcherProvider$TypeOutInvoker.doDispatch(JavaResourceMethodDispatcherProvider.java:205) > > ~[graylog.jar:?] > at > org.glassfish.jersey.server.model.internal.AbstractJavaResourceMethodDispatcher.dispatch(AbstractJavaResourceMethodDispatcher.java:99) > > ~[graylog.jar:?] > at > org.glassfish.jersey.server.model.ResourceMethodInvoker.invoke(ResourceMethodInvoker.java:389) > > ~[graylog.jar:?] > at > org.glassfish.jersey.server.model.ResourceMethodInvoker.apply(ResourceMethodInvoker.java:347) > > ~[graylog.jar:?] > at > org.glassfish.jersey.server.model.ResourceMethodInvoker.apply(ResourceMethodInvoker.java:102) > > ~[graylog.jar:?] > at org.glassfish.jersey.server.ServerRuntime$2.run(ServerRuntime.java:326) > [graylog.jar:?] > at org.glassfish.jersey.internal.Errors$1.call(Errors.java:271) > [graylog.jar:?] > at org.glassfish.jersey.internal.Errors$1.call(Errors.java:267) > [graylog.jar:?] > at org.glassfish.jersey.internal.Errors.process(Errors.java:315) > [graylog.jar:?] > at org.glassfish.jersey.internal.Errors.process(Errors.java:297) > [graylog.jar:?] > at org.glassfish.jersey.internal.Errors.process(Errors.java:267) > [graylog.jar:?] > at > org.glassfish.jersey.process.internal.RequestScope.runInScope(RequestScope.java:317) > > [graylog.jar:?] > at > org.glassfish.jersey.server.ServerRuntime.process(ServerRuntime.java:305) > [graylog.jar:?] > at > org.glassfish.jersey.server.ApplicationHandler.handle(ApplicationHandler.java:1154) > > [graylog.jar:?] > at > org.glassfish.jersey.grizzly2.httpserver.GrizzlyHttpContainer.service(GrizzlyHttpContainer.java:384) > > [graylog.jar:?] > at > org.glassfish.grizzly.http.server.HttpHandler$1.run(HttpHandler.java:224) > [graylog.jar:?] > at > com.codahale.metrics.InstrumentedExecutorService$InstrumentedRunnable.run(InstrumentedExecutorService.java:176) > > [graylog.jar:?] > at > java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142) > > [?:1.8.0_111] > at > java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617) > > [?:1.8.0_111] > at java.lang.Thread.run(Thread.java:745) [?:1.8.0_111] > > > > What am I doing wrong? > > Best, > Frank > -- You received this message because you are subscribed to the Google Groups "Graylog Users" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/graylog2/e9152b92-50da-4806-bdd0-f9aac677d51e%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
