Graylog2 / Graylog2/graylog2-server
Pipeline Rule Improvement - allow more than 2 inputs to concat() function.
- Dominant language
- Java
- Stars
- 8.1k
- Forks
- 1.1k
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 217
Description
Pipeline Rule Improvement - allow more than 2 inputs to concat() function.
## Desired Behavior
When writing a pipeline rule, the Concat function would allow as many inputs as desired.
When writing a pipeline rule, all inputs are treated as type **string**
Eg. the following should ideally parse even with mixed data types.
`concat(a, b, c, d ,e, f, g, h);`
Where a, b ,c are data fields, such as
$message.timestamp
$message.message
$message.source
etc
## Current Behavior
The Concat function is limited to 2 inputs only.
Eg.
`concat(concat(concat(a, b), concat(c, d)), concat(concat(e, f), concat(g, h))); `
It's actually even worse than this, because its also necesarry to include a to_string for each. So it actually looks like this:
`concat(concat(concat(to_string(a), to_string(b)), concat(to_string(c), to_string(d))), concat(concat(to_string(e), to_string(f)), concat(to_string(g), to_string(h)))); `
Ouch!
## Possible Solution
- Allow any number of inputs in Concat function.
- Convert all inputs within Concat function to string data type by default.
## Context
Customer recently asking how to Output a specific format. I directed them to output_pipeline, then realised how unweildy the syntax will be for stitching their fields together.
## Your Environment
4.2.1
Contributor guide
Assessment
This issue has not been assessed yet.