Graylog2 / Graylog2/graylog2-server
pipeline function `array_remove` for list type
- Dominant language
- Java
- Stars
- 8.1k
- Forks
- 1.1k
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 217
Description
Pipeline function `array_remove` removes a specified value. Provide an option (or new function) that takes a list of values to be removed.
## Expected Behavior
Customer provided this sample for a pipeline rule to detect typo-squatting attacks:
```
let listA = ["test","bla","something"];
let listB = ["bla", "something", “tld”];
let a = array_remove(listB, listA);
let b = array_remove(listB, a);
set_field("possible_typosquatting_keywords", b);
```
Expected: result contains values that appear in both `listA` and `listB`: `["bla", "something"]`
## Context
Pipeline rules do not have flow control such as loops. It is currently impossible to accomplish the desired functionality.
Contributor guide
Assessment
This issue has not been assessed yet.