Open drewmiranda-gl opened 4 months ago
noting this is similar to https://github.com/Graylog2/graylog2-server/issues/15534 , however that issue is from Graylog 5.0 so likely something unrelated.
@drewmiranda-gl I just took a quick peek out of curiosity - I am not that familiar with that stuff: just want to point out that the id
s in your example are different. Maybe a copy/paste error? Also the docs state that it has to be a non-forwarder input and the lookup is going via the input registry - so maybe the input you're choosing to test is just a bad candidate?
Also, the code has not been touched for a long time so #15534 is likely related. IMHO.
Good observation :) i added a z
on the end to make sure it didn't match, but other than the z
its the same id.
I observed this behavior at a customer today as well. The customer was using a rule with just a from_input() that was processing (live) messages. Copied message from the very input were not matching in the rule simulator.
(For context: In our rules we usually match against gl2_source_input the way @drewmiranda-gl suggested)
I've never used this function before, but since the pipeline editor defaults to the UI, i thought i'd give the pipeline GUI editor a try.
I cannot get any pipeline rules to correctly return true when i use
from_input
. I'd tried both the input name as well as the input id.Using
get_field("gl2_source_input") == ""
does work.Example:
Pipeline rule:
Expected Behavior
from_input
returns true if the condition is trueCurrent Behavior
from_input
always returns false.Possible Solution
Steps to Reproduce (for bugs)
from_input
using the rule editor testerContext
Your Environment
Please let me know if there are any questions.