0

我正在尝试“美化”我从 Graylog 上的某些 Windows 日志接收到的数据。我的想法是将 Windows 日志 ID 从数字更改为该 ID 的实际定义。例如：我收到一个 ID 为4625的日志，我想在我的小部件中显示"An account failed to log on"。

为此，我使用了一个管道和一个查找表，它从我上传到服务器的 .csv 文件中以自然语言读取 ID 和相应的定义。

这是我为管道编写的规则，似乎不起作用：

rule "eventid_windows_rule"

when

  has_field("winlogbeat_winlog_event_id")

then

let winlogbeat_winlog_italiano = lookup("winlogbeat_winlog_event_id", to_string($message.winlogbeat_winlog_event_id));

set_field("winlogbeat_winlog_italiano", winlogbeat_winlog_italiano);

end

我认为我的问题具体出在这条规则上，因为 Graylog 允许测试查找表，如果我手动编写 ID，查找表会找到相应的描述。

4

1 回答 1

0

I solved the issue myself, this is the correct code for the rule:

rule "eventid_windows_rule"

when

  has_field("winlogbeat_winlog_event_id")

then

let winlogbeat_winlog_italiano = lookup("eventid_widget_windows_lookup", $message.winlogbeat_winlog_event_id);

set_field("winlogbeat_winlog_italiano", winlogbeat_winlog_italiano);

end

This rule checks if the log has the field "winlogbeat_winlog_event_id", then it generates the new field "winlogbeat_winlog_italiano", associates the numeric value of "winlogbeat_winlog_event_id" with the description in natural language thanks to the .csv that I've created, then puts the description in the field "winlogbeat_winlog_italiano".

enter image description here

于 2021-04-03T09:13:33.603 回答