# Feedback on combining message data for lookup

**URL:** <https://community.graylog.org/t/feedback-on-combining-message-data-for-lookup/15144>\
**Category:** Graylog Central (peer support)\
**Tags:** pipeline-rules\
**Created:** [April 26, 2020, 12:07am UTC](https://community.graylog.org/t/feedback-on-combining-message-data-for-lookup/15144 "2020-04-26T00:07:52Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![mh77](https://avatars.discourse-cdn.com/v4/letter/m/5f9b8f/32.png) [@mh77](https://community.graylog.org/u/mh77)\
**Post date:** [April 26, 2020, 12:07am UTC](https://community.graylog.org/t/feedback-on-combining-message-data-for-lookup/15144/1 "2020-04-26T00:07:53Z")

</div>

Hello, I’m really new to the Graylog scene and looking to accomplish what would essentially be a two part lookup.

To explain, when I receive an UPDOWN syslog message from a Cisco switch, I am using an extractor to place the port id (gi1/0/x) in a new message field I’ve called port\_id.

I then want to take the switch’s IP and that port\_id to do a lookup against a CSV table of switches and their port descriptors to create a new message field that will indicate the device connected to that port based upon the port descriptions I’ve pulled from the switches.

What would be the optimal way to go about this, in your opinion? We’re talking less than 2000 devices. My initial thought was examining pipeline rules to perhaps concat the message source IP with the port\_id, and then take that combined value as the single key (and structure my CSV as “IP+Port\_ID”;“Port Desc”) for lookup.

Any insight would be greatly appreciated.

---

<div class="post-metadata">

**Author:** ![mh77](https://avatars.discourse-cdn.com/v4/letter/m/5f9b8f/32.png) [@mh77](https://community.graylog.org/u/mh77)\
**Post date:** [April 29, 2020, 4:48pm UTC](https://community.graylog.org/t/feedback-on-combining-message-data-for-lookup/15144/2 "2020-04-29T16:48:17Z")

</div>

Just following up that I ended up using the method I mentioned at the end to create a unique key for lookup. Plugging that into a pipeline with:

rule “PortLookup”  
when  
has\_field(“port\_id”)  
then  
let ipport = concat(to\_string($message.source), concat(“GigabitEthernet”,to\_string($message.port\_id)));  
let device = lookup\_value(“interface\_lookup”, ipport);  
set\_field(“device\_name”, device);  
end

Worked out great. Just had to remember to put the Pipeline Processor after the Message Filter Chain in System/Configurations.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [May 13, 2020, 4:48pm UTC](https://community.graylog.org/t/feedback-on-combining-message-data-for-lookup/15144/3 "2020-05-13T16:48:19Z")

</div>

Closed on May 13, 2020, 4:48pm UTC

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.