Graylog2 / Graylog2/graylog2-server
Pipeline rule ordering and new function: exit_pipeline()
- Dominant language
- Java
- Stars
- 8.1k
- Forks
- 1.1k
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 217
Description
## What?
Allow for rule ordering in pipeline stages and offer a new function **exit_pipeline()** that would allow you to stop further processing of following rules and stages. Improving processing efficiency.
## How?
Much like giving a numeric to staging for sequence, rules would be set up with non-unique numerical priority allowing you prioritize rules within a stage as needed. All rules can start as priority 0 and would process as they currently do in Graylog. Rules that are less heavily used can be set to a higher number to make sure high traffic rules are executed first. Further facilitating the efficiency is having the new function **exit_pipeline()** that allows you to exit the pipeline if all required actions have been completed before evaluating the next level rules or next level staging. **exit_pipeline()** would also facilitate stopping pipeline processing after a **drop_message()** either embedded as a parameter in **drop_message()** or as a documented follow-on function.
## Why?
This would increase the efficiency of the pipeline where rules that don't need to be processed aren't. In our instance, a pipeline coming from the firewall would evaluate TRAFFIC and THREAT feeds efficiently where when it was noted as TRAFFIC and handled, we can exit the pipeline before having evaluate against all THREAT feed rules.
## Your Environment
* Graylog Version: 3.1.3
* Elasticsearch Version: 6.8.5
* MongoDB Version: 4.0.13
* Operating System: Ubuntu 19.10 eoan
* Browser version: Chrome 78.0.3904.108
Contributor guide
Assessment
This issue has not been assessed yet.