Well, adding a "when" does certainly help, My bad! rule "blacklist" when contains(to_string($message.message), "systemd") then drop_message(); end
On Thursday, January 5, 2017 at 4:29:48 PM UTC+1, Frank wrote: > > Hi there, > > I'm just making my first steps with processing pipelines, and want to > create a rule that blacklists / drops certain messages. > I'm trying to add a rule that looks like this: > > rule "blacklist" > contains(to_string($message), "systemd") > then > drop_message($message) > end > > > When I click "Save" nothing happens and in server.log this appears: > > 2017-01-05T15:24:22.091Z ERROR [PipelineRuleParser] Unable to retrieve > expression for variable contains, this is a bug > 2017-01-05T15:24:22.093Z ERROR [AnyExceptionClassMapper] Unhandled > exception in REST resource > java.lang.NullPointerException > at > org.graylog.plugins.pipelineprocessor.parser.PipelineRuleParser$RuleTypeChecker.exitMessageRef(PipelineRuleParser.java:677) > > ~[?:?] > at > org.graylog.plugins.pipelineprocessor.parser.RuleLangParser$MessageRefContext.exitRule(RuleLangParser.java:672) > > ~[?:?] > at > org.antlr.v4.runtime.tree.ParseTreeWalker.exitRule(ParseTreeWalker.java:71) > ~[?:?] > at org.antlr.v4.runtime.tree.ParseTreeWalker.walk(ParseTreeWalker.java:54) > ~[?:?] > at org.antlr.v4.runtime.tree.ParseTreeWalker.walk(ParseTreeWalker.java:52) > ~[?:?] > at org.antlr.v4.runtime.tree.ParseTreeWalker.walk(ParseTreeWalker.java:52) > ~[?:?] > at org.antlr.v4.runtime.tree.ParseTreeWalker.walk(ParseTreeWalker.java:52) > ~[?:?] > at org.antlr.v4.runtime.tree.ParseTreeWalker.walk(ParseTreeWalker.java:52) > ~[?:?] > at > org.graylog.plugins.pipelineprocessor.parser.PipelineRuleParser.parseRule(PipelineRuleParser.java:136) > > ~[?:?] > at > org.graylog.plugins.pipelineprocessor.rest.RuleResource.createFromParser(RuleResource.java:93) > > ~[?:?] > at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) > ~[?:1.8.0_111] > at > sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) > ~[?:1.8.0_111] > at > sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) > > ~[?:1.8.0_111] > at java.lang.reflect.Method.invoke(Method.java:498) ~[?:1.8.0_111] > at > org.glassfish.jersey.server.model.internal.ResourceMethodInvocationHandlerFactory$1.invoke(ResourceMethodInvocationHandlerFactory.java:81) > > ~[graylog.jar:?] > at > org.glassfish.jersey.server.model.internal.AbstractJavaResourceMethodDispatcher$1.run(AbstractJavaResourceMethodDispatcher.java:144) > > ~[graylog.jar:?] > at > org.glassfish.jersey.server.model.internal.AbstractJavaResourceMethodDispatcher.invoke(AbstractJavaResourceMethodDispatcher.java:161) > > ~[graylog.jar:?] > at > org.glassfish.jersey.server.model.internal.JavaResourceMethodDispatcherProvider$TypeOutInvoker.doDispatch(JavaResourceMethodDispatcherProvider.java:205) > > ~[graylog.jar:?] > at > org.glassfish.jersey.server.model.internal.AbstractJavaResourceMethodDispatcher.dispatch(AbstractJavaResourceMethodDispatcher.java:99) > > ~[graylog.jar:?] > at > org.glassfish.jersey.server.model.ResourceMethodInvoker.invoke(ResourceMethodInvoker.java:389) > > ~[graylog.jar:?] > at > org.glassfish.jersey.server.model.ResourceMethodInvoker.apply(ResourceMethodInvoker.java:347) > > ~[graylog.jar:?] > at > org.glassfish.jersey.server.model.ResourceMethodInvoker.apply(ResourceMethodInvoker.java:102) > > ~[graylog.jar:?] > at org.glassfish.jersey.server.ServerRuntime$2.run(ServerRuntime.java:326) > [graylog.jar:?] > at org.glassfish.jersey.internal.Errors$1.call(Errors.java:271) > [graylog.jar:?] > at org.glassfish.jersey.internal.Errors$1.call(Errors.java:267) > [graylog.jar:?] > at org.glassfish.jersey.internal.Errors.process(Errors.java:315) > [graylog.jar:?] > at org.glassfish.jersey.internal.Errors.process(Errors.java:297) > [graylog.jar:?] > at org.glassfish.jersey.internal.Errors.process(Errors.java:267) > [graylog.jar:?] > at > org.glassfish.jersey.process.internal.RequestScope.runInScope(RequestScope.java:317) > > [graylog.jar:?] > at > org.glassfish.jersey.server.ServerRuntime.process(ServerRuntime.java:305) > [graylog.jar:?] > at > org.glassfish.jersey.server.ApplicationHandler.handle(ApplicationHandler.java:1154) > > [graylog.jar:?] > at > org.glassfish.jersey.grizzly2.httpserver.GrizzlyHttpContainer.service(GrizzlyHttpContainer.java:384) > > [graylog.jar:?] > at > org.glassfish.grizzly.http.server.HttpHandler$1.run(HttpHandler.java:224) > [graylog.jar:?] > at > com.codahale.metrics.InstrumentedExecutorService$InstrumentedRunnable.run(InstrumentedExecutorService.java:176) > > [graylog.jar:?] > at > java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142) > > [?:1.8.0_111] > at > java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617) > > [?:1.8.0_111] > at java.lang.Thread.run(Thread.java:745) [?:1.8.0_111] > > > > What am I doing wrong? > > Best, > Frank > -- You received this message because you are subscribed to the Google Groups "Graylog Users" group. To unsubscribe from this group and stop receiving emails from it, send an email to graylog2+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/graylog2/e9152b92-50da-4806-bdd0-f9aac677d51e%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
