Graylog2 / Graylog2/graylog2-server

Pipeline's rule function split does not accept negative integers

Open
#4,585 0 comments 0 reactions 0 assignees View on GitHub
improvement triaged
Dominant language
Java
Stars
8.1k
Forks
1.1k
Avg merge
1d 20h
Merged PRs (30d)
217

Description

I wanted to split multiple lines string into array of strings and get the last line. After noticing that `\z` regular expression wouldn't work I tried to use `split` in pipelines rules. I tried `split('\n', text, -1)` which result into errors.

## Expected Behavior
Expected to return last value of indexed list resulted from splitting the input.

## Current Behavior
Return error.

## Steps to Reproduce (for bugs)

I used following rule:

```
rule "enrich_message_traceback_with_last_line"
when
has_field("traceback")
then
let traceback_last_line = split("\n", to_string($message.traceback), -1);
set_field(
"traceback_last_line", traceback_last_line
);
end
```

Traceback is the output of failed Python script.

## Context
Maybe the whole solution of getting last line is just overkill and I overlooked some obvious solution. In that case I am sorry to waste your time.

## Your Environment

* Graylog Version: 2.4.3-1
* Elasticsearch Version: 5.0.0-alpha5
* MongoDB Version: 1:2.6.10-0ubuntu1
* Operating System: Ubuntu 16.04.3 LTS
* Browser version: Firefox 58.0.2

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.