Graylog2 / Graylog2/graylog2-server

pipeline function `array_remove` for list type

Open
#24,483 0 comments 0 reactions 0 assignees View on GitHub
feature
Dominant language
Java
Stars
8.1k
Forks
1.1k
Avg merge
1d 20h
Merged PRs (30d)
217

Description

Pipeline function `array_remove` removes a specified value. Provide an option (or new function) that takes a list of values to be removed.

## Expected Behavior

Customer provided this sample for a pipeline rule to detect typo-squatting attacks:

```
let listA = ["test","bla","something"];
let listB = ["bla", "something", “tld”];
let a = array_remove(listB, listA);
let b = array_remove(listB, a);
set_field("possible_typosquatting_keywords", b);
```
Expected: result contains values that appear in both `listA` and `listB`: `["bla", "something"]`

## Context

Pipeline rules do not have flow control such as loops. It is currently impossible to accomplish the desired functionality.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.