Lookup Table Potential Bug

Hello all,

I encountered what I think might be a bug related to lookup tables, and I hoping others can help me confirm this before I go create a bug report on github. I want to do a lookup based on a called phone number. We have SIP data logged into graylog and I would like to tag those records with data from a lookup table. The Key field includes a “+” at the beginning of the data as the phone number is in E164 format.

+12223334444

Setup:
Create a CSV file to test containing this data:
‘phonenumber’;‘areaname’
‘+12226550020’;‘North Area’
‘+12226550021’;‘South Area’

Create a data adapter, cache, and lookup table connecting all of this information. I know I didn’t provide all the information here - I am happy to if it’s not easily understood from the testing.

Testing:
Open the Data Adapter, and attempt to lookup +12226550020. This can’t be found. I think the “+” character in the phonenumber field is the problem.

Modify the CSV file, and remove the “+” character from the data so the file is now this:
‘phonenumber’;‘areaname’
‘12226550020’;‘North Area’
‘12226550021’;‘South Area’

Open the Data Adapter, and attempt to lookup 12226550020. This can be found.
Change the data file back to include the “+” character again.
Open the Data Adapter, and attempt to lookup +12226550020. It fails again.

Thoughts?

I can solve this problem by either mucking around with the SIP data via pipelines, but this seems like something that might catch other folks as they get this setup.

Anybody else having this kind of issue? Is there a good source of debugging information available for me to see what’s happening around this?

Thanks !!
Dustin

Thanks for bringing this up!

There’s a bug in the lookup of values in a data adapter in the web interface:

The lookup in extractors or in pipeline rules via lookup() and lookup_single() should be unaffected by this.

Next time, please provide all details right away. This will save us some time. :wink:

Thank you so much!!

I will make sure to provide more detail the next time I need to post something like this.

Dustin

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.