Managing Lookup Tables Data from Rule

Graylog Add-ons
1

Hi

Is there some sample code where we can make CRUD on lookuptable data from a pipeline rule function
i am writing a function that need to search on lookuptable, and if not found, add an entry to it.
i am aware with the built-in pipeline function “lookup” but i didn’t saw in doc if data can be updated outside the dataadapters mechanism

thanks
Hana

2

Hej @hanabadler

could you please elaborate on your goal.

From what I understand you want to be able to update the content of a data adapter inside a pipeline function?

Thank you
Jan

3

Hi

Yes, here is my example
i have a rule which i wrote a java function.that function use one of the message field, and performs a REST call to 3rd party vendor which return a json result.
i want to store that result, so the next same value is used in the message, i can use stored data and not call the API again.
e.g message contains a phone number. i want to check in the function if phone exist in the lookup table. if not, call the API to the telecom company, and save the result in lookup table.next time, same phone is used, i can take the result from lookup.

thanks
Hana

4

Hi Again

i saw the following java code

but i couldnt understnad how to manage lookuptable.
than i saw this plugin

graylog-plugin-threatintel
and saw some logic in one of the files

final DataAdapterDto saved = dbDataAdapterService.save(DataAdapterDto.builder()
                .id(dataAdapterDto.id())
                .config(updatedConfigBuilder.build())
                .description(dataAdapterDto.description())
                .name(dataAdapterDto.name())
                .contentPack(dataAdapterDto.contentPack())
                .build());

but still it dont looks like the answer
so, maybe you can guide me how to accomplish the task

thanks
Hana

5

Lookup tables are read-only and don’t have the means to be updated from within a pipeline rule.

6

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.