Graylog2 / graylog-plugin-pipeline-processor

[DEPRECATED] Graylog Pipeline Message Processor Plugins
https://www.graylog.org/
GNU General Public License v3.0
21 stars 15 forks source link

Support different abbreviation characters #247

Open lennartkoopmann opened 6 years ago

lennartkoopmann commented 6 years ago

Currently, the abbreviate() function takes two parameters:

Parameter Type Required Description
value String x The string to abbreviate
width Long x The maximum number of characters including the '...' (at least 4)

I suggest adding a new parameter that controls which characters are appended and let it default to .... The reason is, that some users want to change it to something like [abbreviated because message is too long] or [message too long. open log file X on source server] etc.

joschi commented 6 years ago

@lennartkoopmann I think the abbreviate() function should really just abbreviate the input string and not replace it entirely.

Would it help to have a str_length() function which returns the length of a string so that users could write the following rule?

rule "replace-long-string"
when
  str_length(to_string($message.some_field)) > 40
then
  set_field("some_field", "[message too long. open log file X on source server]");
end