Graylog2 / Graylog2/graylog2-server

Pipelines: Add ability to split a value and convert the resulting array values

Open
#11,438 1 comment 3 reactions 0 assignees View on GitHub
feature triaged
Dominant language
Java
Stars
8.1k
Forks
1.1k
Avg merge
1d 20h
Merged PRs (30d)
217

Description

## What?

In Graylog pipelines rules, it is currently possible to split a string value into an array of values (using the `split` pipeline functions), but it is not possible to convert the individual values resulting from the array to another data type (for example, to use the `to_ip` function on each array value). Technically, array values can be accessed by index value for example `array[0] or array[1]` and converted individually, but this is not possible to use on an array of indeterminate length.

## Why?

The user would like to use this functionality to store an array of IP addresses in Elasticsearch with the native IP format type.

For example, from the value: `192.168.1.1,192.168.1.2,192.168.1.3,192.168.1.4`

HS-581667714

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.