Graylog2 / Graylog2/graylog2-server
Pipelines: Add ability to split a value and convert the resulting array values
- Dominant language
- Java
- Stars
- 8.1k
- Forks
- 1.1k
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 217
Description
## What?
In Graylog pipelines rules, it is currently possible to split a string value into an array of values (using the `split` pipeline functions), but it is not possible to convert the individual values resulting from the array to another data type (for example, to use the `to_ip` function on each array value). Technically, array values can be accessed by index value for example `array[0] or array[1]` and converted individually, but this is not possible to use on an array of indeterminate length.
## Why?
The user would like to use this functionality to store an array of IP addresses in Elasticsearch with the native IP format type.
For example, from the value: `192.168.1.1,192.168.1.2,192.168.1.3,192.168.1.4`
HS-581667714
Contributor guide
Assessment
This issue has not been assessed yet.