Graylog Lookup Table returning Null Values for lookup against CSV file?

[Jones453]

Describe your incident:

My Lookup Table in Graylog is returning null values for the lookups to my CSV key:value pairs. For this file, I do have the columns “Snacks,” “Calories,” “Sodium,” and “Type of Snack,” but the key value pair I’ve instructed the adapter to look for is just Snacks (the key, and the first column in this CSV), and the value (which would be the Type of Snack, the last column)

The graylog node is able to read the CSV file path (whose path is recognized in the adapter) but the adapter is returning null values for lookups. the permissions are -rw-r–r-- for the CSV file which was added on the graylog node if that makes a difference.

Below is the null value returned on the lookup

And this below is my CSV;

What steps have you already taken to try and solve the problem?

I’ve made sure that my CSV file uses UTF-8 encoding. I’ve also tried playing around with double quotes, or no quotes in the Key: Value space in the adapter, but to no avail. I use Graylog 4.2

Below is Adapter values

How can the community help?

Some help with editing the Adapter, or even the CSV file if there are issues with formatting, so that the Lookup Table is correctly able to do lookups against the CSV file.

[patrickmann]

Can you also show us a couple of lines from the CSV file itself, rather than the spreadsheet view?
I assume you already reviewed this:

How to Use Graylog Lookup Tables

[Jones453]

@patrickmann Thank you for commenting. I haven’t created the pipeline rule yet. That is a prerequisite required before the lookup table will function as expected, if my understanding is correct? I’ll do that and if errors persist, I’ll get a picture of a couple of lines from the CSV file.

[patrickmann]

You don’t need to define a rule for the lookup table to be functional. You just need an adapter, a cache and the table.

I recreated your example and it worked fine for me. My CSV file looks like this:

Snack,Calories (Best estimate),Amount Sodium,Type of Snack
Chocolate,155,7 mg,Candy
M&M's,240,35 mg,Candy
Cheetos,160,250 mg,Chips

Is that what you have too?

[Jones453]

Hi @patrickmann so I created the adapter, cache, and the table yet I’m getting a null value when trying to do a lookup on the table ; Here’s a screenshot of my CSV

This is a screenshot of the values I used for the adapter, and the cache;

Finally, here’s a screenshot of the null lookup value from the table search;

I’ve made sure that the file is on every graylog server node and is readable. I haven’t included the path in my adapter screenshot, but when I entered it locally, it recognized the path as valid. I’m not sure what the issue could be.

[H077E]

Hi @Jones453
test with single value first
the quote character is ". Set your values in ". e.g. “Snack”,“Type”
Avoid spaces in headings (value columns)

[patrickmann]

What version of Graylog are you running?