Hi Jason, It's hard to tell what is wrong from here, since we can't exactly see how your messages look like. Could you share a couple of messages with us?
Please be aware that at the moment, the "regex" function needs to match the whole string: https://github.com/Graylog2/graylog-plugin-pipeline-processor/issues/35 We will release a Graylog 2.1.0 alpha really soon, and it would be really helpful to know what you think about the new pipeline simulator. It's still a work in progress, just as the pipeline processor, but hopefully will help you debug your pipelines and rules. Regards, Edmundo > On 07 Jul 2016, at 23:31, Jason Haar <jason_h...@trimble.com> wrote: > > > On Wed, Jul 6, 2016 at 9:50 PM, Jochen Schalanda <joc...@graylog.com> wrote: > there's something coming up in Graylog 2.1.0 which will vastly simplify > testing pipeline rules. > > That's great to hear. Any suggestions as to what's wrong with my rule? > > Thanks > > > -- > Cheers > > Jason Haar > Information Security Manager, Trimble Navigation Ltd. > Phone: +1 408 481 8171 > PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1 > > -- > You received this message because you are subscribed to the Google Groups > "Graylog Users" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to graylog2+unsubscr...@googlegroups.com. > To view this discussion on the web visit > https://groups.google.com/d/msgid/graylog2/CAFChrgL7rcbe_rFpciwxs%3D5%3Dh%3D%3DXC7E3mdXWyO-skSP4ZjidCg%40mail.gmail.com. > For more options, visit https://groups.google.com/d/optout. -- You received this message because you are subscribed to the Google Groups "Graylog Users" group. To unsubscribe from this group and stop receiving emails from it, send an email to graylog2+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/graylog2/CE4236F5-A849-43F0-A8B2-BA9BD79A359C%40graylog.com. For more options, visit https://groups.google.com/d/optout.
