graylog-plugin-pipeline-processor
graylog-plugin-pipeline-processor copied to clipboard
Support different abbreviation characters
trafficstars
Currently, the abbreviate() function takes two parameters:
| Parameter | Type | Required | Description |
|---|---|---|---|
| value | String | x | The string to abbreviate |
| width | Long | x | The maximum number of characters including the '...' (at least 4) |
I suggest adding a new parameter that controls which characters are appended and let it default to .... The reason is, that some users want to change it to something like [abbreviated because message is too long] or [message too long. open log file X on source server] etc.
@lennartkoopmann I think the abbreviate() function should really just abbreviate the input string and not replace it entirely.
Would it help to have a str_length() function which returns the length of a string so that users could write the following rule?
rule "replace-long-string"
when
str_length(to_string($message.some_field)) > 40
then
set_field("some_field", "[message too long. open log file X on source server]");
end