Lookup Table Issue: HTTP JSONPath

Hello Community /Developers,

We are using HTTP JSONPath as Data Adapter Type in lookup tables to accomplish multi value lookup. But, unfortunately Lookup is not working. Please help us to resolve the issue.

We created a rest API using python flask and accessing the URL like below:



  "ioc_details": {
    "date": "2018-09-26", 
    "feed_name": "abuse.ch-SSL-IP-Blacklist", 
    "feed_overlap_count": "1", 
    "feed_url": "https://sslbl.abuse.ch/blacklist/sslipblacklist.csv", 
    "ioc": "", 
    "ioc_type": "ADDR"

Lookup Table Configuration:

jsonlookup (HTTP JSONPath)
Description				jsonlookup
Lookup URL
Single value JSONPath	$.ioc_details
Multi value JSONPath	$.ioc_details
HTTP User-Agent			Graylog Lookup - https://www.graylog.org/
HTTP Headers			Name	Value

Pipeline Rule:

rule "json_ti_lookup"
when has_field("src")
// Get the user login from the message
let source = to_string($message.src);
// Lookup the multi value in the jsonlookup lookup table
let tiData = lookup("jsonlookup", source);
set_field("json_feed_overlap_count", tiData["feed_overlap_count"]);
set_field("json_feed_name", tiData["feed_name"]);

Heyo @naren

your single value lookup is not configured properly. As the name suggests, it expects to only return a single property. Your JSONPath is pointing at an entire object. You’ll have to use something of the line $.ioc_details.feed_name, that only returns a single property/field for the single value lookup :slight_smile:



Thanks, Philipp :slightly_smiling_face: Below changes in the config worked.

Lookup URL:${key}

Single value JSONPath: $.ioc_details.feed_name

Lookup URL :
Single value JSONPath: $.ioc_details

1 Like

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.