Lookup tables with multi value, pipelines and accessing data

Graylog Central (peer support)
,
1

Hello!

I’ve been trying to configure a simple pipeline rule to parse a JSONPath data table. The result of the lookup via the lookup test is the following:

{
  "single_value": "Mobile Safari",
  "multi_value": {
    "UserAgent": {
      "Family": "Mobile Safari",
      "Major": "5",
      "Minor": "1",
      "Patch": ""
    },
    "Os": {
      "Family": "iOS",
      "Major": "5",
      "Minor": "1",
      "Patch": "1",
      "PatchMinor": ""
    },
    "Device": {
      "Family": "iPad",
      "Brand": "Apple",
      "Model": "iPad"
    }
  },
  "ttl": 9223372036854776000,
  "empty": false
}

Using the pipeline rule debugger function though I’m only able to retrieve the single_value, not the multi_value:

debug(data); // Mobile Safari
debug(data.UserAgent.Family); // Passed value is NULL

What am I missing?

Thanks :slight_smile:

2

What’s the complete rule you’re using?
What’s the content of the data variable?

FWIW, you can either use a single value lookup (lookup_value()) or a multi value lookup ( lookup()) but not both in the same function call.

3

That was the issue :slight_smile:
Thanks, my bad :smile:

4

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.