# How to create a muti-value lookup

**URL:** <https://community.graylog.org/t/how-to-create-a-muti-value-lookup/4614>\
**Category:** Graylog Central (peer support)\
**Created:** [March 18, 2018, 12:47pm UTC](https://community.graylog.org/t/how-to-create-a-muti-value-lookup/4614 "2018-03-18T12:47:37Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![cdeng](https://avatars.discourse-cdn.com/v4/letter/c/e79b87/32.png) [@cdeng](https://community.graylog.org/u/cdeng)\
**Post date:** [March 18, 2018, 12:47pm UTC](https://community.graylog.org/t/how-to-create-a-muti-value-lookup/4614/1 "2018-03-18T12:47:37Z")

</div>

Hi all,

The document has mentioned about supporting multi-value lookup.  
is there any sample reference for creating a multi-value lookup ? especially the sample format of a CSV file for muti-value lookup ?

best wishes  
charles

---

<div class="post-metadata">

**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\
**Post date:** [March 18, 2018, 1:50pm UTC](https://community.graylog.org/t/how-to-create-a-muti-value-lookup/4614/2 "2018-03-18T13:50:43Z")

</div>

The multi-value lookup with a CSV file data adapter would simply return the complete row of the CSV file matching the lookup key instead of just a single column of that row.

---

<div class="post-metadata">

**Author:** ![cdeng](https://avatars.discourse-cdn.com/v4/letter/c/e79b87/32.png) [@cdeng](https://community.graylog.org/u/cdeng)\
**Post date:** [March 18, 2018, 3:58pm UTC](https://community.graylog.org/t/how-to-create-a-muti-value-lookup/4614/3 "2018-03-18T15:58:30Z")

</div>

Hi Jochen,

i remain cannot catch this. for example, to return the result of the geo-ip in the document as the following, how to write the correspond row in the CSV?

 ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/7/7b629d702797277653831cb072f54be72561931d.png)

Best wishes  
charles

---

<div class="post-metadata">

**Author:** ![cdeng](https://avatars.discourse-cdn.com/v4/letter/c/e79b87/32.png) [@cdeng](https://community.graylog.org/u/cdeng)\
**Post date:** [March 18, 2018, 4:30pm UTC](https://community.graylog.org/t/how-to-create-a-muti-value-lookup/4614/4 "2018-03-18T16:30:38Z")

</div>

for example, i have a data to settings mapping, so I have a following CSV file:

```auto
data,s1,s2,s3,s4,s5,s6
0,false,false,false,false,false,false
1,true,false,false,false,false,false
2,false,true,false,false,false,false
3,true,true,false,false,false,false

```

now the lookup test result for key=1 being

![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/6/62fd7aa50e1331fa07563f4d0d9ec68b203dd180.png)

the multi-value result remain take only just one collumn of a row.

---

<div class="post-metadata">

**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\
**Post date:** [March 18, 2018, 4:40pm UTC](https://community.graylog.org/t/how-to-create-a-muti-value-lookup/4614/5 "2018-03-18T16:40:51Z")

</div>

I’m afraid I was wrong about the CSV file data adapter and it only supports returning a singular value (from the “value” column you’ve configured).

---

<div class="post-metadata">

**Author:** ![cdeng](https://avatars.discourse-cdn.com/v4/letter/c/e79b87/32.png) [@cdeng](https://community.graylog.org/u/cdeng)\
**Post date:** [March 19, 2018, 2:00am UTC](https://community.graylog.org/t/how-to-create-a-muti-value-lookup/4614/6 "2018-03-19T02:00:17Z")

</div>

by the way, there is a statement for lookup results in the document:

```auto
The single value can be a string, number or boolean and will be used in extractors, converters, decorators and pipeline rules. 

```

but per my test, it seems the lookup results with CSV data adapter always being **string** , never being number and boolean.

---

<div class="post-metadata">

**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\
**Post date:** [March 19, 2018, 7:37am UTC](https://community.graylog.org/t/how-to-create-a-muti-value-lookup/4614/7 "2018-03-19T07:37:05Z")

</div>

> [@cdeng](#):
>
> never being number and boolean.

Correct, because there is no type information in a CSV file, so the CSV parser and Graylog assumes that every value from the CSV file is a string.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [April 2, 2018, 7:37am UTC](https://community.graylog.org/t/how-to-create-a-muti-value-lookup/4614/8 "2018-04-02T07:37:07Z")

</div>

Closed on April 2, 2018, 7:37am UTC

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.