Graylog2 / Graylog2/graylog2-server

Enrich event message with additional fields

Open
#10,389 3 comments 1 reaction 0 assignees View on GitHub
feature processing triaged
Dominant language
Java
Stars
8.1k
Forks
1.1k
Avg merge
1d 20h
Merged PRs (30d)
217

Description

## What?
I would love to see the details from my events in extra fields in the message. All events are in the stream "All events". The event-id is stored in the field event_definition_id. I would like to have
* the name of that event
* if the event was grouped by same field the value which triggered the event
* the value of the measurement (count(), card(), ...)

Example:
The event looks as following:
suspicious ssh logins: 123.123.123.123 - count(ip)=42
event_name: suspicious ssh logins
event_grouped_by:123.123.123.123
event_measurement:42

## Why?
I wanted to create those extra fields with a grok pattern on the stream. But as the "All Events"-Stream has no inputs, this generates an errormessage:
![grafik](https://user-images.githubusercontent.com/74296413/114044524-9869a780-9887-11eb-8022-906d7c0d3d08.png)

I have a case where I have to adjust the limits for different users/IPs (=group by values) for the thresholds. As I have quite a few false positives in the beginning I'd like to exclude them and set them to another limit.

## Your Environment

* Graylog Version: Graylog 4.0.5
The rest is not relevant I quess.

This issue could also help with #9438

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.