Graylog2 / Graylog2/graylog2-server

"$message.stage" cannot be used in pipeline rules

Open
#5,281 1 comment 1 reaction 0 assignees View on GitHub
bug
Dominant language
Java
Stars
8.1k
Forks
1.1k
Avg merge
1d 20h
Merged PRs (30d)
217

Description

## Expected Behavior
Use "$message.stage" as field in a pipeline rule source

## Current Behavior
Field "$message.stage" cannot be used. Graylog returns an "mismatched input" error when using "$message.stage" in the "to_string" comparison. Is "stage" a reserved word here?
![rule](https://user-images.githubusercontent.com/182060/48343530-eb1ce600-e672-11e8-8a37-80666a0d2794.png)

We wanted to use it as a dtap differentiator.
same rule works when using "$message.stageeee" or "$message.stage2" as field
![rule_ok](https://user-images.githubusercontent.com/182060/48343539-eeb06d00-e672-11e8-80db-9b2a99769d74.png)

## Possible Solution
Clarify in the docs, that "stage" (and other?) are reserved words in some functions - or make them work again.

## Steps to Reproduce (for bugs)
1. use "message.stage" in a "to_string" comparison rule
2.
3.
4.

## Context
We wanted to use it as a dtap differentiator.
We just use a new field "env" for that purpose. So not that big of a problem.

## Your Environment

* Graylog Version: graylog-server-2.4.6
* Elasticsearch Version: elasticsearch-5.6.9-1
* MongoDB Version: mongodb-2.6.12
* Operating System: RHEL 7.6
* Browser version: Chrome/Linux

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.