# CSV lookup table delete fails

**URL:** <https://community.graylog.org/t/csv-lookup-table-delete-fails/2561>\
**Category:** Graylog Central (peer support)\
**Created:** [September 25, 2017, 12:33pm UTC](https://community.graylog.org/t/csv-lookup-table-delete-fails/2561 "2017-09-25T12:33:32Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![jtkarvo](https://avatars.discourse-cdn.com/v4/letter/j/43a26b/32.png) [@jtkarvo](https://community.graylog.org/u/jtkarvo)\
**Post date:** [September 25, 2017, 12:33pm UTC](https://community.graylog.org/t/csv-lookup-table-delete-fails/2561/1 "2017-09-25T12:33:33Z")

</div>

hi,

I created a CSV lookup table, with Graylog 2.3.1. I accidentally misspelled the file name. This resulted in error in UI (the triangle), due to missing file. I edited the correct filename in the UI, and the error vanished from the UI. But the java exceptions keep occurring in the log file. So I decided to delete the whole lookup data adapter. The adapter vanished from the UI, but - the java exceptions keep occurring on the log file.

I have a setup of 5 Graylog nodes, and don’t see any problems with their connectivity with each other.

```
2017-09-25T15:28:18.778+03:00 ERROR [CSVFileDataAdapter] Couldn't check data adapter <malware-patrol-domain> CSV file /graylog/threatintel/feed_mwp_domain.csv for updates: java.nio.file.NoSuchFileException /graylog/threatintel/feed_mwp_domain.csv
2017-09-25T15:28:45.743+03:00 ERROR [LookupDataAdapter] Couldn't refresh data adapter <malware-domain/59c0f8fd91ad3a0432d9fd30/@5236f163>
java.lang.NullPointerException: null
        at org.graylog2.lookup.adapters.CSVFileDataAdapter.doRefresh(CSVFileDataAdapter.java:102) ~[graylog.jar:?]
        at org.graylog2.plugin.lookup.LookupDataAdapter.refresh(LookupDataAdapter.java:89) ~[graylog.jar:?]
        at org.graylog2.lookup.LookupDataAdapterRefreshService.lambda$schedule$0(LookupDataAdapterRefreshService.java:142) ~[graylog.jar:?]
        at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511) [?:1.8.0_141]
        at java.util.concurrent.FutureTask.runAndReset(FutureTask.java:308) [?:1.8.0_141]
        at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$301(ScheduledThreadPoolExecutor.java:180) [?:1.8.0_141]
        at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:294) [?:1.8.0_141]
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) [?:1.8.0_141]
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) [?:1.8.0_141]
        at java.lang.Thread.run(Thread.java:748) [?:1.8.0_141]

```

Any idea on how to remove this stuff from mongodb? Or other hints?

---

<div class="post-metadata">

**Author:** ![jaskis](https://avatars.discourse-cdn.com/v4/letter/j/c0e974/32.png) [@jaskis](https://community.graylog.org/u/jaskis)\
**Post date:** [September 25, 2017, 12:35pm UTC](https://community.graylog.org/t/csv-lookup-table-delete-fails/2561/2 "2017-09-25T12:35:59Z")

</div>

Had the same issue, a quick dirty workaround - restart of the server. I just did that during the patching window. It does not impact the performance, just an annoying message.

---

<div class="post-metadata">

**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\
**Post date:** [September 25, 2017, 2:57pm UTC](https://community.graylog.org/t/csv-lookup-table-delete-fails/2561/3 "2017-09-25T14:57:03Z")

</div>

could you please create an github issue for that.

thank you

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [October 9, 2017, 2:57pm UTC](https://community.graylog.org/t/csv-lookup-table-delete-fails/2561/4 "2017-10-09T14:57:29Z")

</div>

Closed on October 9, 2017, 2:57pm UTC

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.