1. Describe your incident:
Could someone help me? I can’t find the solution to my problem. I just want to write an integer into my dynamic lookup table, but I still only get 0 entries in my database. I would appreciate it, if someone could help me please.
This is how my Lookup Tables, Caches, Adapter, Rules and so on look like
Below is a copy paste of the test rule just in case and after that are my cache and LUT config, I kept everything as default.
rule "lookup mongo test"
when
true
then
let test = to_string($message.message);
lookup_add_string_list(
lookup_table: "test2",
key: "test2",
value: [test]
);
end
First, thanks. Now I get some entries into my database, but only when I run a simulation. For example, I run a simulation and receive the entries, but when I generate downtime and get the log file into my Graylog and use that rule, I want to save the value of start_epoch, but it’s not being added to my database entry. I don’t know why.
"Stage 2 must occur before Stage 3 (which involves writing the start and end epochs into the lookup table). This is because Stage 2 parses the date into an epoch, which is why it needs to be completed before Stage 3. I’ve already tried using set_field("true", true); to see if it passes the when statement and proceeds to the lookup_add_string_list.