crowdsec/pkg/parser/tests/multi-stage-grok/base-grok-s01.yaml
Thibault bui Koechlin 2016167654 initial import
2020-05-15 11:39:16 +02:00

12 lines
265 B
YAML

#only one of the events is going to throu filter
filter: "evt.Parsed.extracted_value == 'VALUE1'"
debug: true
onsuccess: next_stage
name: tests/second-stage-grok
statics:
- meta: did_second_stage
value: yes
- target: evt.Parsed.test_bis
value: lolilol