Graylog2 / Graylog2/graylog2-server
Enrich event message with additional fields
- Dominant language
- Java
- Stars
- 8.1k
- Forks
- 1.1k
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 217
Description
## What?
I would love to see the details from my events in extra fields in the message. All events are in the stream "All events". The event-id is stored in the field event_definition_id. I would like to have
* the name of that event
* if the event was grouped by same field the value which triggered the event
* the value of the measurement (count(), card(), ...)
Example:
The event looks as following:
suspicious ssh logins: 123.123.123.123 - count(ip)=42
event_name: suspicious ssh logins
event_grouped_by:123.123.123.123
event_measurement:42
## Why?
I wanted to create those extra fields with a grok pattern on the stream. But as the "All Events"-Stream has no inputs, this generates an errormessage:

I have a case where I have to adjust the limits for different users/IPs (=group by values) for the thresholds. As I have quite a few false positives in the beginning I'd like to exclude them and set them to another limit.
## Your Environment
* Graylog Version: Graylog 4.0.5
The rest is not relevant I quess.
This issue could also help with #9438
Contributor guide
Assessment
This issue has not been assessed yet.