I encountered what I think might be a bug related to lookup tables, and I hoping others can help me confirm this before I go create a bug report on github. I want to do a lookup based on a called phone number. We have SIP data logged into graylog and I would like to tag those records with data from a lookup table. The Key field includes a “+” at the beginning of the data as the phone number is in E164 format.
Create a CSV file to test containing this data:
Create a data adapter, cache, and lookup table connecting all of this information. I know I didn’t provide all the information here - I am happy to if it’s not easily understood from the testing.
Open the Data Adapter, and attempt to lookup +12226550020. This can’t be found. I think the “+” character in the phonenumber field is the problem.
Modify the CSV file, and remove the “+” character from the data so the file is now this:
Open the Data Adapter, and attempt to lookup 12226550020. This can be found.
Change the data file back to include the “+” character again.
Open the Data Adapter, and attempt to lookup +12226550020. It fails again.
I can solve this problem by either mucking around with the SIP data via pipelines, but this seems like something that might catch other folks as they get this setup.
Anybody else having this kind of issue? Is there a good source of debugging information available for me to see what’s happening around this?