How to create a muti-value lookup

Graylog Central (peer support)
1

Hi all,

The document has mentioned about supporting multi-value lookup.
is there any sample reference for creating a multi-value lookup ? especially the sample format of a CSV file for muti-value lookup ?

best wishes
charles

2

The multi-value lookup with a CSV file data adapter would simply return the complete row of the CSV file matching the lookup key instead of just a single column of that row.

3

Hi Jochen,

i remain cannot catch this. for example, to return the result of the geo-ip in the document as the following, how to write the correspond row in the CSV?

image
image.png878×514 25.8 KB

Best wishes
charles

4

for example, i have a data to settings mapping, so I have a following CSV file:

data,s1,s2,s3,s4,s5,s6
0,false,false,false,false,false,false
1,true,false,false,false,false,false
2,false,true,false,false,false,false
3,true,true,false,false,false,false

now the lookup test result for key=1 being

image

the multi-value result remain take only just one collumn of a row.

5

I’m afraid I was wrong about the CSV file data adapter and it only supports returning a singular value (from the “value” column you’ve configured).

6

by the way, there is a statement for lookup results in the document:

The single value can be a string, number or boolean and will be used in extractors, converters, decorators and pipeline rules.

but per my test, it seems the lookup results with CSV data adapter always being string, never being number and boolean.

7

Correct, because there is no type information in a CSV file, so the CSV parser and Graylog assumes that every value from the CSV file is a string.

8

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.