1. Describe your incident:
We have created a lookup table which has worked but is now failing.
We have a http service which lookup SID and convert to account names.
We have created a HTTP JSONPath data adapter:
URL: http://converter.domain.local:8080/sid?sid=${key}
Single value JSONPath: $.name
Multi value JSONPath: $.SamAccountName
Testing the data adapter, with a key: S-1-5-21-1651537450-2263746518-3493629508-5756
returns:
{
“single_value”: “John Doe”,
“multi_value”: {
“value”: “user12345”
},
“string_list_value”: null,
“has_error”: false,
“ttl”: 9223372036854776000
}
We have created a local-in-mem cache and a Lookup table which use the cache and the data adapter.
While testing the lookup adapter with the exact same key used in previous test gives this error in the logs:
2023-08-09 11:34:58,065 WARN : org.graylog2.lookup.adapters.HTTPJSONPathDataAdapter - Couldn’t read single JSONPath from response - returning empty result (Expected to find an object with property [‘name’] in path $ but found ‘java.lang.String’. This is not a json object according to the JsonProvider: ‘com.jayway.jsonpath.spi.json.JsonSmartJsonProvider’.)
We don’t know was cause this error, any help?
2. Describe your environment:
Docker image: graylog/graylog:5.0.2
3. What steps have you already taken to try and solve the problem?
Recreated data adapter, cache and lookup table
The settings you are asking abut, are in the previous message:
And the data adapter itself is working, so the return value from the HTTP service are indeed a valid json format.
The return string from the http service is like this: { “name”: “John Doe”, “SamAccountName”: “user12345”, “Type”: “User” }
In the adapter settings I have change the “Multi value JSONPath” to: $
and used the multi value in pipelines rule, which works. But testing the lookup table are still failing with the same error. to me it seems like a bug.
If there is a bug, I cannot reproduce it. I created a data adapter, in-mem cache and lookup table similar to yours. No issues.
The error message is telling you that the JSONpath is invalid (not that it could not parse returned data). Does the adapter always return a “name” field or could it sometimes be missing?
