# I want to create/connect pipeline rule with lookup table

**URL:** <https://community.graylog.org/t/i-want-to-create-connect-pipeline-rule-with-lookup-table/36064>\
**Category:** Graylog Central (peer support)\
**Created:** [July 22, 2025, 7:26am UTC](https://community.graylog.org/t/i-want-to-create-connect-pipeline-rule-with-lookup-table/36064 "2025-07-22T07:26:48Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![cashews](https://avatars.discourse-cdn.com/v4/letter/c/51bf81/32.png) [@cashews](https://community.graylog.org/u/cashews)\
**Post date:** [July 22, 2025, 7:26am UTC](https://community.graylog.org/t/i-want-to-create-connect-pipeline-rule-with-lookup-table/36064/1 "2025-07-22T07:26:48Z")

</div>

Before you post: Your responses to these questions will help the community help you. Please complete this template if you’re asking a support question.  
**Don’t forget to select tags to help index your topic!**

**1. Describe your incident:**  
I’m currently setting up an alert in Graylog to notify me when someone logs in via SSH **from an IP address**. So far, the alert is working as expected.

What I want to do now is to refine the alert — I only want to be notified **if the SSH login comes from an IP address that is outside a specific trusted range** (e.g. `100.100.100.1` to `100.100.100.5`).

The goal is to **ignore logins from trusted IPs** and only alert when the source IP is not part of that trusted list.

**2. Describe your environment:**  
I am using Graylog 6.1.0

**3. What steps have you already taken to try and solve the problem?**  
I’m currently using a Lookup Table approach. Here are the steps I’ve taken so far:  
1.Created a **Data Adapter** using a CSV file and placed the file on the server.  
→ I tested the adapter, and the lookup returns the correct value. Fig.01  
2. Configured the **Cache** for the adapter. Fig.02  
3. Created and configured the **Lookup Table** , linking it to the adapter and cache. Fig.03  
4. Verified that the lookup works correctly via the test function in the Lookup Table. Fig.04  
5. Here is my Pipeline rule

```auto
rule "Audit - sshd: login accepted (password)"
when
    contains(to_string($message.message), "sshd[") AND
    contains(to_string($message.message), "Accepted password for")
then
    let grok_pattern = "%{HOSTNAME:hostname} %{WORD:process}\\[%{NUMBER:pid}\\]: Accepted password for %{USERNAME:target_user} from %{IPV4:source_ip} port %{NUMBER:source_port} %{WORD:protocol}";
    let extracted = grok(grok_pattern, to_string($message.message));
    let source_ip = to_string(extracted["source_ip"]);
    set_field("source_ip", source_ip);
    

    // Defensive coding: only proceed if IP was extracted
    let ip_parts = split(source_ip, "\\.");
    let ip_int = to_long(ip_parts[0]) * 256 * 256 * 256 +
                 to_long(ip_parts[1]) * 256 * 256 +
                 to_long(ip_parts[2]) * 256 +
                 to_long(ip_parts[3]);

    set_field("ip_integer", ip_int); // 👈 DEBUG OUTPUT

    let trusted_min = 192 * 256 * 256 * 256 + 168 * 256 * 256 + 100 * 256 + 1;
    let trusted_max = 192 * 256 * 256 * 256 + 168 * 256 * 256 + 100 * 256 + 5;

    let outside = ip_int < trusted_min || ip_int > trusted_max;
    set_field("untrusted_check_result", outside); // 👈 TEMP FIELD for confirmation

    // Final flag for alerting
    set_field("untrusted_ssh_login", outside);
end

```

1. Test run rule simulation. I want if it can show the field “Trusted IP” or “Untrusted IP”.Fig.05

**4. How can the community help?**

- Could there be a mistake in how I’m using the lookup table within the pipeline rule?
- Is there a better or more reliable way to check if an IP address is **not** in the trusted list?
- What’s the recommended method to troubleshoot or debug the result of `lookup_value()` inside a pipeline rule?
- Are there any working examples or best practices for using CSV-based lookups in Graylog pipeline rules?
- Do I need to revise or fix my current pipeline rule logic?

Here is the reference Image  
Fig.01 -

 ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/a/0/a0cc3fbcdd0599c92ebb8017c035bf1312af6cea.png)  
Fig.02 -  
 ![Fig.02](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/a/1/a17de0d0d7fbc4b125735582827474ab96b7f299.png)  
Fig.03 -  
 ![Fig.03](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/b/0/b00d2b8e4b8c93d2ee12f1ea07a3b2219138581d.png)  
Fig.04 -  
 ![Fig.04](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/5/c56255f9941e9857834eda6cad7169009f9e0f1e.png)  
Fig.05 -  
 ![Fig.05](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/5/0/5010599f25b1d1ab7c35fb1cd23534e70c545f13.png)

---

<div class="post-metadata">

**Author:** ![mulo](https://avatars.discourse-cdn.com/v4/letter/m/a9a28c/32.png) [@mulo](https://community.graylog.org/u/mulo)\
**Post date:** [August 4, 2025, 8:34am UTC](https://community.graylog.org/t/i-want-to-create-connect-pipeline-rule-with-lookup-table/36064/2 "2025-08-04T08:34:25Z")

</div>

I cant see any line for looking up your ip address against the lookup-table.

I looks like you check the ip address with the trusted\_min / \_max values and not against your csv?

Your pipeline should contains something like this:  
let lookup\_result = lookup\_value(“trusted\_ips\_lookup”, source\_ip);  
After this, you have to store the output-value from the lookup-table in your variable

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [August 18, 2025, 8:34am UTC](https://community.graylog.org/t/i-want-to-create-connect-pipeline-rule-with-lookup-table/36064/3 "2025-08-18T08:34:38Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.