HTTP JSON lookup adapter can not find property

1. Describe your incident:
We have created a lookup table which has worked but is now failing.

We have a http service which lookup SID and convert to account names.
We have created a HTTP JSONPath data adapter:
URL: http://converter.domain.local:8080/sid?sid=${key}
Single value JSONPath: $.name
Multi value JSONPath: $.SamAccountName

Testing the data adapter, with a key: S-1-5-21-1651537450-2263746518-3493629508-5756
“single_value”: “John Doe”,
“multi_value”: {
“value”: “user12345”
“string_list_value”: null,
“has_error”: false,
“ttl”: 9223372036854776000

We have created a local-in-mem cache and a Lookup table which use the cache and the data adapter.
While testing the lookup adapter with the exact same key used in previous test gives this error in the logs:
2023-08-09 11:34:58,065 WARN : org.graylog2.lookup.adapters.HTTPJSONPathDataAdapter - Couldn’t read single JSONPath from response - returning empty result (Expected to find an object with property [‘name’] in path $ but found ‘java.lang.String’. This is not a json object according to the JsonProvider: ‘com.jayway.jsonpath.spi.json.JsonSmartJsonProvider’.)

We don’t know was cause this error, any help?

2. Describe your environment:
Docker image: graylog/graylog:5.0.2

3. What steps have you already taken to try and solve the problem?
Recreated data adapter, cache and lookup table

4. How can the community help?

Helpful Posting Tips: Tips for Posting Questions that Get Answers [Hold down CTRL and link on link to open tips documents in a separate tab]

I believe the log message is saying the text retrieved via the HTTP lookup couldn’t be parsed as json.

Can you share your data adapter config and paste an example response from the HTTP lookup?

The settings you are asking abut, are in the previous message:

And the data adapter itself is working, so the return value from the HTTP service are indeed a valid json format.
The return string from the http service is like this: { “name”: “John Doe”, “SamAccountName”: “user12345”, “Type”: “User” }

In the adapter settings I have change the “Multi value JSONPath” to: $
and used the multi value in pipelines rule, which works. But testing the lookup table are still failing with the same error. to me it seems like a bug.

If there is a bug, I cannot reproduce it. I created a data adapter, in-mem cache and lookup table similar to yours. No issues.

The error message is telling you that the JSONpath is invalid (not that it could not parse returned data). Does the adapter always return a “name” field or could it sometimes be missing?

How are you testing the lookup table?

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.