Http json lookup and pipeline rule

[dio99]

i got the lookup working to MISP but i cant get the pipeline to work… any hints on this
rule “[MISP] Add Threat Info from MISP httpjson lookup Dest ip”

when
//has_field (“SourceIP”) OR
has_field(“DestinationIP”)
then
let DestinationIP = to_string($message.DestinationIP);
//let SourceIP = to_string($message.SourceIP);

//debug($message.DestinationIP);
let lookupResult = lookup("misp-lookup", DestinationIP); // Do Lookup.
set_field("MISP_EventID", lookupResult.event_id);
set_field("MISP_EventInfo", lookupResult.category);

//debug(lookupResult );
end

also tested with set_field(“MISP_EventID”, lookupResult.[*].event_id);

[shoothub]

What about:

set_field("MISP_EventID", lookupResult[0].event_id);

[dio99]

dont work that since it says string
it comlains about
lookupResult[0]

[tmacgbay]

-----------------------------------------> to_string()