Skip to content

Instantly share code, notes, and snippets.

@bmanojlovic
Last active August 29, 2015 13:56
Show Gist options
  • Save bmanojlovic/8860899 to your computer and use it in GitHub Desktop.
Save bmanojlovic/8860899 to your computer and use it in GitHub Desktop.
drool rule for 0.20.x graylog2
import org.graylog2.plugin.Message
rule "Drop vmware guest crap"
when
m : Message( getField("message") matches "\\[ warning\\] \\[vmusr:vmusr\\] Error in the RPC receive loop: RpcIn.*" );
then
m.setFilterOut(true);
#System.out.println( "[DROOL] : " + m.toString() ); # too verbose crap...
end
rule "Drop ESX cosmetic crap"
when
m : Message( getField("full_message") matches "Hostd.*Unable.to.parse.(Min|Max)Ram(PerCpu)?.value.*" )
then
m.setFilterOut(true);
System.out.println( "[DROOL] : " + m.toString() );
end
rule "Drop hostd spam"
when
m : Message( getField("full_message") matches ".*Malformed.guest.uptime.string.*" )
then
m.setFilterOut(true);
end
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment