Graylog2 / Graylog2/graylog2-server

Pipeline rule ordering and new function: exit_pipeline()

Open
#7,002 1 comment 4 reactions 0 assignees View on GitHub
feature triaged
Dominant language
Java
Stars
8.1k
Forks
1.1k
Avg merge
1d 20h
Merged PRs (30d)
217

Description

## What?
Allow for rule ordering in pipeline stages and offer a new function **exit_pipeline()** that would allow you to stop further processing of following rules and stages. Improving processing efficiency.

## How?
Much like giving a numeric to staging for sequence, rules would be set up with non-unique numerical priority allowing you prioritize rules within a stage as needed. All rules can start as priority 0 and would process as they currently do in Graylog. Rules that are less heavily used can be set to a higher number to make sure high traffic rules are executed first. Further facilitating the efficiency is having the new function **exit_pipeline()** that allows you to exit the pipeline if all required actions have been completed before evaluating the next level rules or next level staging. **exit_pipeline()** would also facilitate stopping pipeline processing after a **drop_message()** either embedded as a parameter in **drop_message()** or as a documented follow-on function.

## Why?

This would increase the efficiency of the pipeline where rules that don't need to be processed aren't. In our instance, a pipeline coming from the firewall would evaluate TRAFFIC and THREAT feeds efficiently where when it was noted as TRAFFIC and handled, we can exit the pipeline before having evaluate against all THREAT feed rules.

## Your Environment

* Graylog Version: 3.1.3
* Elasticsearch Version: 6.8.5
* MongoDB Version: 4.0.13
* Operating System: Ubuntu 19.10 eoan
* Browser version: Chrome 78.0.3904.108

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.