Graylog2 / Graylog2/graylog2-server
Pipeline's rule function split does not accept negative integers
- Dominant language
- Java
- Stars
- 8.1k
- Forks
- 1.1k
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 217
Description
I wanted to split multiple lines string into array of strings and get the last line. After noticing that `\z` regular expression wouldn't work I tried to use `split` in pipelines rules. I tried `split('\n', text, -1)` which result into errors.
## Expected Behavior
Expected to return last value of indexed list resulted from splitting the input.
## Current Behavior
Return error.
## Steps to Reproduce (for bugs)
I used following rule:
```
rule "enrich_message_traceback_with_last_line"
when
has_field("traceback")
then
let traceback_last_line = split("\n", to_string($message.traceback), -1);
set_field(
"traceback_last_line", traceback_last_line
);
end
```
Traceback is the output of failed Python script.
## Context
Maybe the whole solution of getting last line is just overkill and I overlooked some obvious solution. In that case I am sorry to waste your time.
## Your Environment
* Graylog Version: 2.4.3-1
* Elasticsearch Version: 5.0.0-alpha5
* MongoDB Version: 1:2.6.10-0ubuntu1
* Operating System: Ubuntu 16.04.3 LTS
* Browser version: Firefox 58.0.2
Contributor guide
Assessment
This issue has not been assessed yet.