# Lookup tables with multi value, pipelines and accessing data

**URL:** <https://community.graylog.org/t/lookup-tables-with-multi-value-pipelines-and-accessing-data/3918>\
**Category:** Graylog Central (peer support)\
**Tags:** pipeline-rules, debuggingpl\
**Created:** [January 23, 2018, 8:38pm UTC](https://community.graylog.org/t/lookup-tables-with-multi-value-pipelines-and-accessing-data/3918 "2018-01-23T20:38:36Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![elegos](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/elegos/32/1639_2.png) [@elegos](https://community.graylog.org/u/elegos)\
**Post date:** [January 23, 2018, 8:38pm UTC](https://community.graylog.org/t/lookup-tables-with-multi-value-pipelines-and-accessing-data/3918/1 "2018-01-23T20:38:36Z")

</div>

Hello!

I’ve been trying to configure a simple pipeline rule to parse a JSONPath data table. The result of the lookup via the lookup test is the following:

```
{
  "single_value": "Mobile Safari",
  "multi_value": {
    "UserAgent": {
      "Family": "Mobile Safari",
      "Major": "5",
      "Minor": "1",
      "Patch": ""
    },
    "Os": {
      "Family": "iOS",
      "Major": "5",
      "Minor": "1",
      "Patch": "1",
      "PatchMinor": ""
    },
    "Device": {
      "Family": "iPad",
      "Brand": "Apple",
      "Model": "iPad"
    }
  },
  "ttl": 9223372036854776000,
  "empty": false
}

```

Using the pipeline rule debugger function though I’m only able to retrieve the single\_value, not the multi\_value:

```
debug(data); // Mobile Safari
debug(data.UserAgent.Family); // Passed value is NULL

```

What am I missing?

Thanks 🙂

---

<div class="post-metadata">

**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\
**Post date:** [January 24, 2018, 9:05am UTC](https://community.graylog.org/t/lookup-tables-with-multi-value-pipelines-and-accessing-data/3918/2 "2018-01-24T09:05:48Z")

</div>

What’s the complete rule you’re using?  
What’s the content of the `data` variable?

FWIW, you can _either_ use a single value lookup (`lookup_value()`) _or_ a multi value lookup ( `lookup()`) but not both in the same function call.

---

<div class="post-metadata">

**Author:** ![elegos](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/elegos/32/1639_2.png) [@elegos](https://community.graylog.org/u/elegos)\
**Post date:** [January 24, 2018, 9:46am UTC](https://community.graylog.org/t/lookup-tables-with-multi-value-pipelines-and-accessing-data/3918/3 "2018-01-24T09:46:07Z")

</div>

That was the issue 🙂  
Thanks, my bad 😄

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [February 7, 2018, 9:46am UTC](https://community.graylog.org/t/lookup-tables-with-multi-value-pipelines-and-accessing-data/3918/4 "2018-02-07T09:46:07Z")

</div>

Closed on February 7, 2018, 9:46am UTC

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.