I know that in a Log Decoder Service, the log processing sequence is like:
Parsers --> Rules --> Feeds
but, I need to create an App Rule to generate meta based on other meta generated by a custom feed.
The use case is as follows:
I got a user.src and search that username in a custom feed. The feed enrich that meta with a new one: user.src.name. I want to generate an alert meta when in a log I got user.src but not user.src.name.