Graylog2 / Graylog2/graylog2-server
"$message.stage" cannot be used in pipeline rules
- Dominant language
- Java
- Stars
- 8.1k
- Forks
- 1.1k
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 217
Description
## Expected Behavior
Use "$message.stage" as field in a pipeline rule source
## Current Behavior
Field "$message.stage" cannot be used. Graylog returns an "mismatched input" error when using "$message.stage" in the "to_string" comparison. Is "stage" a reserved word here?

We wanted to use it as a dtap differentiator.
same rule works when using "$message.stageeee" or "$message.stage2" as field

## Possible Solution
Clarify in the docs, that "stage" (and other?) are reserved words in some functions - or make them work again.
## Steps to Reproduce (for bugs)
1. use "message.stage" in a "to_string" comparison rule
2.
3.
4.
## Context
We wanted to use it as a dtap differentiator.
We just use a new field "env" for that purpose. So not that big of a problem.
## Your Environment
* Graylog Version: graylog-server-2.4.6
* Elasticsearch Version: elasticsearch-5.6.9-1
* MongoDB Version: mongodb-2.6.12
* Operating System: RHEL 7.6
* Browser version: Chrome/Linux
Contributor guide
Assessment
This issue has not been assessed yet.