28 Oct 2022 08:32 AM - last edited on 02 Nov 2022 01:36 AM by MaciejNeumann
I have written a log processing rule to parse a log file. Some log events have a secondary event log level that can be different from primary log level. I want to set both the event's loglevel and status to the secondary log level. When I test the rule it works perfectly, setting both the loglevel and status to "WARNING" using a FIELD_ADD. However, when that rule is used to ingest the log data both fields are set to "NONE". Is there something more I need to do?
Solved! Go to Solution.
@ChadTurner Yes, I just needed to another command to update the status field.