Extractor with Lookup Table

Graylog Central (peer support)
1

Hi everyone,

I’m using a lookup table with MAC Addresse and AP Names.

I don’t understand why my extractor is missing everything.

I have a pipeline that process those message first, and then I expect my extractor to extract and add a field with the associated value from the lookup table.

firefox_2019-01-07_15-24-35
firefox_2019-01-07_15-24-35.png1356×866 48.4 KB

2

I was able to use a rule in my pipeline instead of that extractor.

rule "Convert BSSID to DeviceName"
when
  has_field("bssid")
then
  let name = lookup_value("unifi-device-name", $message.bssid);
  set_field("DeviceName", name);
end
3

using extractors or processing pipelines is the better idea - depending on your processing order some information might not be given for the other system. As extractors might run before the processing pipelines.

4

I have placed Message Filter Chain on top of the Pipeline Processor.

Are extractors run by the Message Filter Chain or somewhere else in the chain?

5

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.