graylog2grayloggraylog3

How to change a numeric ID into a sentence in Graylog using pipelines?


I am trying to "beautify" the data I receive from some windows logs on Graylog. My idea is to change the windows log ID from a number to the actual definition for that ID. For example: I receive a log with ID 4625, I want to show in my widget "An account failed to log on".

To do that, I am using a pipeline and a lookup table, which reads the IDs and the respective definitions in natural language from a .csv that I've uploaded on the server.

This is the rule that I wrote for my pipeline, that doesn't seem to work:

rule "eventid_windows_rule"

when

  has_field("winlogbeat_winlog_event_id")

then

let winlogbeat_winlog_italiano = lookup("winlogbeat_winlog_event_id", to_string($message.winlogbeat_winlog_event_id));

set_field("winlogbeat_winlog_italiano", winlogbeat_winlog_italiano);

end

I think my problem is specifically in this rule, because Graylog allows to test the lookup tables, and if I manually write an ID, the lookup table finds the respective description.


Solution

  • I solved the issue myself, this is the correct code for the rule:

    rule "eventid_windows_rule"
    
    when
    
      has_field("winlogbeat_winlog_event_id")
    
    then
    
    let winlogbeat_winlog_italiano = lookup("eventid_widget_windows_lookup", $message.winlogbeat_winlog_event_id);
    
    set_field("winlogbeat_winlog_italiano", winlogbeat_winlog_italiano);
    
    end
    

    This rule checks if the log has the field "winlogbeat_winlog_event_id", then it generates the new field "winlogbeat_winlog_italiano", associates the numeric value of "winlogbeat_winlog_event_id" with the description in natural language thanks to the .csv that I've created, then puts the description in the field "winlogbeat_winlog_italiano".

    enter image description here