Extractor with Lookup Table


(Alexis Vézina) #1

Hi everyone,

I’m using a lookup table with MAC Addresse and AP Names.

I don’t understand why my extractor is missing everything.

I have a pipeline that process those message first, and then I expect my extractor to extract and add a field with the associated value from the lookup table.


(Alexis Vézina) #2

I was able to use a rule in my pipeline instead of that extractor.

rule "Convert BSSID to DeviceName"
when
  has_field("bssid")
then
  let name = lookup_value("unifi-device-name", $message.bssid);
  set_field("DeviceName", name);
end

(Jan Doberstein) #3

using extractors or processing pipelines is the better idea - depending on your processing order some information might not be given for the other system. As extractors might run before the processing pipelines.


(Alexis Vézina) #4

I have placed Message Filter Chain on top of the Pipeline Processor.

Are extractors run by the Message Filter Chain or somewhere else in the chain?


(system) closed #5

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.