# Lookup Tables problem

**URL:** <https://community.graylog.org/t/lookup-tables-problem/33261>\
**Category:** Graylog Central (peer support)\
**Created:** [August 15, 2024, 7:39am UTC](https://community.graylog.org/t/lookup-tables-problem/33261 "2024-08-15T07:39:31Z")\
**Posts on this page:** 16\
**Page:** 1

<div class="post-metadata">

**Author:** ![roaringkitty](https://avatars.discourse-cdn.com/v4/letter/r/cab0a1/32.png) [@roaringkitty](https://community.graylog.org/u/roaringkitty)\
**Post date:** [August 15, 2024, 7:39am UTC](https://community.graylog.org/t/lookup-tables-problem/33261/1 "2024-08-15T07:39:31Z")

</div>

**1. Describe your incident:**  
Could someone help me? I can’t find the solution to my problem. I just want to write an integer into my dynamic lookup table, but I still only get 0 entries in my database. I would appreciate it, if someone could help me please.

This is how my Lookup Tables, Caches, Adapter, Rules and so on look like

 ![lookup](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/4/3/43e99a2efa4c2f6a6c06f4f7cecbc6d86acf8c62.png)  
 ![Caches](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/6/c65bafd6f3d0085bf0daf4005cbd38c307a15f2c.png)  
 ![Data Adapter](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/b/4/b435b2f64d00983814315a16c1dc4ebd4538d935.png)  
 ![Log](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/1/f/1f36ab99e384902ad2dcef7272bf8352c457e4ab.png)  
 ![0 entries](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/0/6/0662388cffe19336fc3a55ae3b710dc9b17b5a53.png)  
 ![Rule](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/a/d/ade24aea3c6a8e05d56dca8ae29d7d9b68d6cbc7.png)

**2. Describe your environment:**

- OS Information:  
Windows
- Package Version:  
6.0.3

---

<div class="post-metadata">

**Author:** ![Wine\_Merchant](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/wine_merchant/32/14596_2.png) [@Wine\_Merchant](https://community.graylog.org/u/Wine_Merchant)\
**Post date:** [August 15, 2024, 8:35am UTC](https://community.graylog.org/t/lookup-tables-problem/33261/2 "2024-08-15T08:35:44Z")

</div>

Hello @roaringkitty,

Are you able to manually add keys and values to this LUT and can you see anything in the logs related to the rule you created?

---

<div class="post-metadata">

**Author:** ![roaringkitty](https://avatars.discourse-cdn.com/v4/letter/r/cab0a1/32.png) [@roaringkitty](https://community.graylog.org/u/roaringkitty)\
**Post date:** [August 16, 2024, 8:21am UTC](https://community.graylog.org/t/lookup-tables-problem/33261/3 "2024-08-16T08:21:48Z")

</div>

If you mean it that way, I didn’t get any entries. I also looked into the server log files, but I didn’t find any of that or any errors either.

 ![entries](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/5/8/580dfff51130d9aa43b3cb4d822ccf2c48b2892d.png)  
 ![rules](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/0/6/06684b3bd80e99acb1e78aa5898552353ebfde9e.png)

---

<div class="post-metadata">

**Author:** ![Wine\_Merchant](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/wine_merchant/32/14596_2.png) [@Wine\_Merchant](https://community.graylog.org/u/Wine_Merchant)\
**Post date:** [August 16, 2024, 9:25am UTC](https://community.graylog.org/t/lookup-tables-problem/33261/4 "2024-08-16T09:25:50Z")

</div>

@roaringkitty I ran a quick test using the the rule simulator

 ![Screenshot 2024-08-16 at 10.21.45](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/7/7/777f6552b24eb2f9583f4bc8c5c9ee327ca82f6f.png)

When checking the data adapter for the key name I tested with I can see the results have been written to Mongo.

 ![Screenshot 2024-08-16 at 10.22.39](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/5/3/538f8910c3af86f8f56ad54613a8e371658bb39b.png)

What if you create variables that contain “hello” and “byebye” and use those variables within the value part of your lookup\_set\_string\_list functions.

---

<div class="post-metadata">

**Author:** ![roaringkitty](https://avatars.discourse-cdn.com/v4/letter/r/cab0a1/32.png) [@roaringkitty](https://community.graylog.org/u/roaringkitty)\
**Post date:** [August 16, 2024, 9:41am UTC](https://community.graylog.org/t/lookup-tables-problem/33261/5 "2024-08-16T09:41:51Z")

</div>

Hey Wine could you show me please your caches and lookup Table too ? how did.

Because i wrote the exact same rule like you but i did not get an entrie. i would appreciate it ! Thanks for helping me

---

<div class="post-metadata">

**Author:** ![Wine\_Merchant](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/wine_merchant/32/14596_2.png) [@Wine\_Merchant](https://community.graylog.org/u/Wine_Merchant)\
**Post date:** [August 16, 2024, 9:59am UTC](https://community.graylog.org/t/lookup-tables-problem/33261/6 "2024-08-16T09:59:16Z")

</div>

Below is a copy paste of the test rule just in case and after that are my cache and LUT config, I kept everything as default.

```auto
rule "lookup mongo test"

when
true
then

let test = to_string($message.message);

lookup_add_string_list(
    lookup_table: "test2",
    key: "test2",
    value: [test]
    );
end

```

 ![Screenshot 2024-08-16 at 10.58.19](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/5/a/5a0593dcf3a1b509a24647bcf0be9c139955fabe.png)  
 ![Screenshot 2024-08-16 at 10.58.33](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/e/a/ea080fab1461925095d41f2c05ba23a3e3aa6243.png)

---

<div class="post-metadata">

**Author:** ![roaringkitty](https://avatars.discourse-cdn.com/v4/letter/r/cab0a1/32.png) [@roaringkitty](https://community.graylog.org/u/roaringkitty)\
**Post date:** [August 16, 2024, 10:50am UTC](https://community.graylog.org/t/lookup-tables-problem/33261/7 "2024-08-16T10:50:13Z")

</div>

First, thanks. Now I get some entries into my database, but only when I run a simulation. For example, I run a simulation and receive the entries, but when I generate downtime and get the log file into my Graylog and use that rule, I want to save the value of `start_epoch`, but it’s not being added to my database entry. I don’t know why.

_Rule_

 ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/0/3/0319c2ed072f267be5e1bcf592b094d919b4ec5a.png)

_New Log File_

 ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/b/e/be89bf635c900e2219a7622116b83ce166845eb1.png)  
_Data Adapter_  
 ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/e/7/e75a4ecbf4c795648364827a4733c345f0498cc4.png)

---

<div class="post-metadata">

**Author:** ![Wine\_Merchant](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/wine_merchant/32/14596_2.png) [@Wine\_Merchant](https://community.graylog.org/u/Wine_Merchant)\
**Post date:** [August 16, 2024, 12:08pm UTC](https://community.graylog.org/t/lookup-tables-problem/33261/8 "2024-08-16T12:08:09Z")

</div>

Could you show the pipeline configuration this rule is associated with and confirm that pipeline is attached to the stream the message is routed to.

Also please confirm your process order is as below.

 ![Screenshot 2024-08-16 at 13.07.43](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/6/5/65430007a76f64861281deb2543cec9c9db8476b.png)

---

<div class="post-metadata">

**Author:** ![roaringkitty](https://avatars.discourse-cdn.com/v4/letter/r/cab0a1/32.png) [@roaringkitty](https://community.graylog.org/u/roaringkitty)\
**Post date:** [August 16, 2024, 12:24pm UTC](https://community.graylog.org/t/lookup-tables-problem/33261/9 "2024-08-16T12:24:25Z")

</div>

![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/8/b/8b5daa35748e24ec883c0d988d4c9ab609f3e699.png)

 ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/b/5/b58eaa754097b8953362ced819b59f8f417890d4.png)

 ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/7/a/7a5a61501570c64f756eba1fe1eaaecd2a7b4971.png)

I hope these screenshots provide you with enough information. Thanks in advance

---

<div class="post-metadata">

**Author:** ![Wine\_Merchant](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/wine_merchant/32/14596_2.png) [@Wine\_Merchant](https://community.graylog.org/u/Wine_Merchant)\
**Post date:** [August 16, 2024, 3:09pm UTC](https://community.graylog.org/t/lookup-tables-problem/33261/10 "2024-08-16T15:09:21Z")

</div>

I’m not seeing anything that outwardly is incorrect, could you try with the rule in stage 0 just to make sure messages are making it to stage one.

Also for the purpose of that test make the when clause just ‘true’.

---

<div class="post-metadata">

**Author:** ![roaringkitty](https://avatars.discourse-cdn.com/v4/letter/r/cab0a1/32.png) [@roaringkitty](https://community.graylog.org/u/roaringkitty)\
**Post date:** [August 16, 2024, 3:47pm UTC](https://community.graylog.org/t/lookup-tables-problem/33261/11 "2024-08-16T15:47:32Z")

</div>

![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/9/c/9c27254bde0a3f8131166d7beb9b0ecaee635fa9.png)

"Stage 2 must occur before Stage 3 (which involves writing the start and end epochs into the lookup table). This is because Stage 2 parses the date into an epoch, which is why it needs to be completed before Stage 3. I’ve already tried using `set_field("true", true);` to see if it passes the `when` statement and proceeds to the `lookup_add_string_list`.

---

<div class="post-metadata">

**Author:** ![Wine\_Merchant](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/wine_merchant/32/14596_2.png) [@Wine\_Merchant](https://community.graylog.org/u/Wine_Merchant)\
**Post date:** [August 19, 2024, 8:42am UTC](https://community.graylog.org/t/lookup-tables-problem/33261/12 "2024-08-19T08:42:40Z")

</div>

Tricky one, I would introduce the debug function just to see if the fields you are attempting to add to the LUT contain data.

Also upon having a second look at the screenshots you sent it does appear that the downtime rule is having errors processing, what would those be?

 ![Screenshot 2024-08-19 at 09.35.55](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/e/a/eaa099d3df65d9f829f43b21f0a2c25f5587117e.png)

---

<div class="post-metadata">

**Author:** ![roaringkitty](https://avatars.discourse-cdn.com/v4/letter/r/cab0a1/32.png) [@roaringkitty](https://community.graylog.org/u/roaringkitty)\
**Post date:** [August 19, 2024, 2:07pm UTC](https://community.graylog.org/t/lookup-tables-problem/33261/13 "2024-08-19T14:07:05Z")

</div>

Yes, I’m going to have a look at it! I appreciate your help, buddy

---

<div class="post-metadata">

**Author:** ![roaringkitty](https://avatars.discourse-cdn.com/v4/letter/r/cab0a1/32.png) [@roaringkitty](https://community.graylog.org/u/roaringkitty)\
**Post date:** [August 20, 2024, 12:12pm UTC](https://community.graylog.org/t/lookup-tables-problem/33261/14 "2024-08-20T12:12:54Z")

</div>

I don’t know exactly how I did it, but now I have some entries in my database! Thanks a lot again for your help.

---

<div class="post-metadata">

**Author:** ![Wine\_Merchant](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/wine_merchant/32/14596_2.png) [@Wine\_Merchant](https://community.graylog.org/u/Wine_Merchant)\
**Post date:** [August 20, 2024, 12:59pm UTC](https://community.graylog.org/t/lookup-tables-problem/33261/15 "2024-08-20T12:59:45Z")

</div>

🤝

Great work all around!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [September 3, 2024, 12:59pm UTC](https://community.graylog.org/t/lookup-tables-problem/33261/16 "2024-09-03T12:59:51Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.