Index error in pipeline rule

[giveen]

I have this rule and it works but I’m also still getting errors with it, lol, despite it working

rule "ParseAndLookupMACVendor"
when
  has_field("source_mac")
then
  set_field("source_mac_vendor", "unknown");
  let s = split(":", to_string($message.source_mac));
  let prefix0 = concat(to_string(s[0]), ":");
  let prefix1 = concat(to_string(s[1]), ":");
  let macprefix0 = concat(to_string(prefix0), to_string(prefix1));
  let macprefix = concat(to_string(macprefix0), to_string(s[2]));
  let macvendor = lookup_value("mac-vendor-csv", macprefix);
  set_field("source_mac_vendor", macvendor);
end

Error:

(Error: In call to function 'to_string' at 8:23 an exception was thrown: index (1) must be less than size (1))

[tmacgbay]

try putting quotes on your index numbers? Total guess…

EDIT: Don’t. I was wrong. Ignore that part.

  let prefix0 = concat(to_string(s["0"]), ":");
  let prefix1 = concat(to_string(s["1"]), ":");
...
  let macprefix = concat(to_string(macprefix0), to_string(s["2"]));

or… source_mac perhaps has something other than a MAC in it… You can put in:

debug(concat("+++ source_mac: ",to_string($message.source_mac)));

and watch the log files to see what your actual source_mac is coming across as.

tail -f /var/log/graylog-server/server.log

~or~

perhaps you can make sure you have a MAC in the when/then

rule "ParseAndLookupMACVendor"
when
  has_field("source_mac") &&
  regex ("^(?:(?:[0-9A-Fa-f]{2}(?=([-:]))(?:\1[0-9A-Fa-f]{2}){5}))$", to_string($message.source_mac)) == ""
then

[giveen]

Yeah, annoying isn’t it?

1. Caused Expected type Long but found String when indexing and wouldnt let me save the rule.
2. Ran into issues with another rule I have that looks for randomized MAC’s.

[tmacgbay]

Just ignore my unresearched and poor suggestion to put quotes in there. I don’t see anything wrong with how split() is being used - that suggests the error is because you have something other than a MAC coming in for source_mac If validating the MAC causes errors elsewhere… doesn’t that mean that you have non MAC things coming through that would cause an error here?

here is an alternative rule - grab the first 8 char, look them up, if they don’t exist default the result to “unknown” and set the field as such.

rule "ParseAndLookupMACVendor"
when
  has_field("source_mac")
then

  let macprefix = substring(to_string($message.source_mac),0,8);
  let macvendor = lookup_value("mac-vendor-csv", macprefix,"unknown");
  set_field("source_mac_vendor", macvendor);

end

[giveen]

That worked so much better with my next rule was to test if the MAC was randomized or not.

I really appreciate your help.

[tmacgbay]

Mark it as the answer for future searches! Hopefully they will ignore my previous bad advice!