graylog2-server icon indicating copy to clipboard operation
graylog2-server copied to clipboard

pipeline function `array_remove` for list type

Open patrickmann opened this issue 1 month ago • 0 comments

Pipeline function array_remove removes a specified value. Provide an option (or new function) that takes a list of values to be removed.

Expected Behavior

Customer provided this sample for a pipeline rule to detect typo-squatting attacks:

let listA = ["test","bla","something"];
let listB = ["bla", "something", “tld”];
let a = array_remove(listB, listA);
let b = array_remove(listB, a);
set_field("possible_typosquatting_keywords", b);

Expected: result contains values that appear in both listA and listB: ["bla", "something"]

Context

Pipeline rules do not have flow control such as loops. It is currently impossible to accomplish the desired functionality.

patrickmann avatar Dec 09 '25 07:12 patrickmann