Graylog2 / Graylog2/graylog2-server

Processing function `length` of field

Open
#4,871 3 comments 4 reactions 0 assignees View on GitHub
feature triaged
Dominant language
Java
Stars
8.1k
Forks
1.1k
Avg merge
1d 20h
Merged PRs (30d)
217

Description

## Current Behavior
When you are in the need to check the `length` of a field inside a message you are forced to work with heavy regex on that field. Just to shorten the field (what might be needed to work around some limits (like seen in https://github.com/Graylog2/graylog2-server/issues/873 ) but that is not always the best/wanted solution.

In the end you need to write rules like:

```
rule "drop messages over 16383 characters"
when
has_field("message") AND
regex(to_string($message.message), ^.{16383,}$).matches == true
then
drop_message();
debug( concat("dropped oversized message from ", to_string($message.source))
end
```

## Possible Solution
Create the function `length` that can be used in various ways. To check the lenght of a string in `when` condition with `true` or `false` indicator.

```
rule "drop message over 16383 characters"
when
has_field("message") AND
lenght(to_string($message.message), 16383).true
then
drop_message();
debug( concat("dropped oversized message from ", to_string($message.source))
end
```

```
rule "check hostname length"
when
has_field("hostname") AND
lenght(to_string($message.hostname), 12).false
then
set_field("hostname_invalid", true)
end

```

It should also allow to check similar to the `-gt` and `-lt` of the bash test command that you finally can check the for exact length and something bigger or lower than the length of the give string.

## Your Environment
* Graylog Version: 2.4.5

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.