graylog-plugin-pipeline-processor icon indicating copy to clipboard operation
graylog-plugin-pipeline-processor copied to clipboard

Support different abbreviation characters

Open lennartkoopmann opened this issue 6 years ago • 1 comments

Currently, the abbreviate() function takes two parameters:

Parameter Type Required Description
value String x The string to abbreviate
width Long x The maximum number of characters including the '...' (at least 4)

I suggest adding a new parameter that controls which characters are appended and let it default to .... The reason is, that some users want to change it to something like [abbreviated because message is too long] or [message too long. open log file X on source server] etc.

lennartkoopmann avatar Apr 16 '18 17:04 lennartkoopmann

@lennartkoopmann I think the abbreviate() function should really just abbreviate the input string and not replace it entirely.

Would it help to have a str_length() function which returns the length of a string so that users could write the following rule?

rule "replace-long-string"
when
  str_length(to_string($message.some_field)) > 40
then
  set_field("some_field", "[message too long. open log file X on source server]");
end

joschi avatar Apr 17 '18 08:04 joschi