Lookup Tables dsv files

(Christoph Kirchner) #1

I want to use a txt file from http://rules.emergingthreats.net/blockrules/compromised-ips.txt for a lookup table.
I choose DSV File from HTTP and I check only the presense of the ip address.
But I have no idea which Line Separator I have to choose.
I tried \n and \r\n and both did not work. Any other ideas?

(Jan Doberstein) #2

The DSV Lookup will work only with key - value lookups. A simple “is present, then true” is not possible.

(Christoph Kirchner) #3

But there is a check box for “Check Presence Only” “Only check if key is present in table, returns boolean instead of value.”
Is there an other option to check against such a list like http://rules.emergingthreats.net/blockrules/compromised-ips.txt
The list only conains a list of ip addresses.
For Example:

(Jan Doberstein) #4

Sorry missed that check on the presence.

You might want to create a feature request because it is not possible to have a list without quote character. That is what you actually have with that list.

This should be done in the server repo: https://github.com/Graylog2/graylog2-server/issues

(Christoph Kirchner) #5

Hi Jan,

I will create an feature request this week.
For now I will fetch the file with wget and with a sed script I will add the quote character.
Then I put it an my local http server and take my local, quoted source

Thanks for your quick support

(Christoph Kirchner) #6

(system) #7

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.