The pipeline rule created when using a Wizard List can lead to wrong results

[frantz45]

The pipeline rule uses the following condition to check if a value is in the list: contains(to_string("wizard_lookup", "my_lookup", "")), to_string($message.fieldname), true) So the list is processed as a String which can lead to wrong results. For example if my list is "administrator; toto; root; foobar", and the value of "fieldname" is "admin". "admin" is included in administrator so the contains() function will return True, but it should have return False as "admin" isn't in the list.

I think you should create a function "is_value_in_list" (because it seems Graylog doesn't provide it) so we could do: is_value_in_list(to_string($message.fieldname), split(";", to_string("wizard_lookup", "my_lookup", "")))

[frantz45]

Graylog's community finds a nice solution and it's easy to implement:

rule "is_value_in_list"
when
regex("^(admin|root|toto|foo)$", $message.user).matches == true then set_field("user_in_list", "True"); end

Graylog Comunity: pipeline-check-if-a-value-is-in-a-list

[c8y3]

Rather, add "is in lookup" and "is not in lookup" as new options in the alert rule definition

[frantz45]

The new pipeline rule based on a lookup works well with no wrong results