Hi Jason, It's hard to tell what is wrong from here, since we can't exactly see how your messages look like. Could you share a couple of messages with us?
Please be aware that at the moment, the "regex" function needs to match the whole string: https://github.com/Graylog2/graylog-plugin-pipeline-processor/issues/35 We will release a Graylog 2.1.0 alpha really soon, and it would be really helpful to know what you think about the new pipeline simulator. It's still a work in progress, just as the pipeline processor, but hopefully will help you debug your pipelines and rules. Regards, Edmundo > On 07 Jul 2016, at 23:31, Jason Haar <[email protected]> wrote: > > > On Wed, Jul 6, 2016 at 9:50 PM, Jochen Schalanda <[email protected]> wrote: > there's something coming up in Graylog 2.1.0 which will vastly simplify > testing pipeline rules. > > That's great to hear. Any suggestions as to what's wrong with my rule? > > Thanks > > > -- > Cheers > > Jason Haar > Information Security Manager, Trimble Navigation Ltd. > Phone: +1 408 481 8171 > PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1 > > -- > You received this message because you are subscribed to the Google Groups > "Graylog Users" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > To view this discussion on the web visit > https://groups.google.com/d/msgid/graylog2/CAFChrgL7rcbe_rFpciwxs%3D5%3Dh%3D%3DXC7E3mdXWyO-skSP4ZjidCg%40mail.gmail.com. > For more options, visit https://groups.google.com/d/optout. -- You received this message because you are subscribed to the Google Groups "Graylog Users" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/graylog2/CE4236F5-A849-43F0-A8B2-BA9BD79A359C%40graylog.com. For more options, visit https://groups.google.com/d/optout.
