Graylog2 / Graylog2/graylog2-server

Pipeline Rule Improvement - allow more than 2 inputs to concat() function.

Open
#11,752 1 comment 0 reactions 0 assignees View on GitHub
improvement processing triaged
Dominant language
Java
Stars
8.1k
Forks
1.1k
Avg merge
1d 20h
Merged PRs (30d)
217

Description

Pipeline Rule Improvement - allow more than 2 inputs to concat() function.

## Desired Behavior
When writing a pipeline rule, the Concat function would allow as many inputs as desired.

When writing a pipeline rule, all inputs are treated as type **string**

Eg. the following should ideally parse even with mixed data types.
`concat(a, b, c, d ,e, f, g, h);`

Where a, b ,c are data fields, such as

$message.timestamp
$message.message
$message.source
etc

## Current Behavior
The Concat function is limited to 2 inputs only.

Eg.
`concat(concat(concat(a, b), concat(c, d)), concat(concat(e, f), concat(g, h))); `

It's actually even worse than this, because its also necesarry to include a to_string for each. So it actually looks like this:

`concat(concat(concat(to_string(a), to_string(b)), concat(to_string(c), to_string(d))), concat(concat(to_string(e), to_string(f)), concat(to_string(g), to_string(h)))); `

Ouch!

## Possible Solution
- Allow any number of inputs in Concat function.
- Convert all inputs within Concat function to string data type by default.

## Context
Customer recently asking how to Output a specific format. I directed them to output_pipeline, then realised how unweildy the syntax will be for stitching their fields together.

## Your Environment
4.2.1

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.