我正在尝试在管道中创建一条规则,在该规则中可以(通过编程或通过硬编码)在消息中存储数组。
下面是我的代码:
rule "sample_rule"
when
to_string($message.desired_column_name) == "test_value"
then
let msg = create_message("", "");
let id = to_string($message.desired_column_name);
let labels = ["FOO", "BAR"]; <<<<<<<<<<<<< Trying to store as an array here, but array data type is not (natively)supported.
set_field("id", id, "", "", msg);
set_field("labels", labels, "", "", msg);
route_to_stream("output_stream", "", msg);
end
我也经历过docs和几个community posts,但是还没有发现任何真正表明支持数组的东西。
是否可以通过某些插件在Graylog管道中具有数组数据类型的变量?