Graylog Pipelinie规则数组变量

时间:2019-07-05 11:37:31

标签: graylog2 graylog

我正在尝试在管道中创建一条规则,在该规则中可以(通过编程或通过硬编码)在消息中存储数组。

下面是我的代码:

rule "sample_rule"
when
    to_string($message.desired_column_name) == "test_value"
then
    let msg = create_message("", "");
    let id = to_string($message.desired_column_name);
    let labels = ["FOO", "BAR"]; <<<<<<<<<<<<< Trying to store as an array here, but array data type is not (natively)supported.
    set_field("id", id, "", "", msg);
    set_field("labels", labels, "", "", msg);
    route_to_stream("output_stream", "", msg);
end

我也经历过docs和几个community posts,但是还没有发现任何真正表明支持数组的东西。

是否可以通过某些插件在Graylog管道中具有数组数据类型的变量?

0 个答案:

没有答案