Multi-Value lookup table in pipeline WHEN clause

[bradleykite]

Hi there,

Is it possible to use multi-value lookup values inside of the WHEN statement in a pipeline rule?

For example, within a THEN statement, it is possible to do this:

let geo = lookup(“geoip-lookup”, to_string($message.remote_ip));
geo[“country”].iso_code

But how can I do the same in the WHEN statement?

rule “check_last_location”
when
has_field(“remote_ip”) &&
lookup(“geoip-lookup”, $message.remote_ip)) ??? How to reference [“country”].iso_code
then
set_field(“VPN-location-unexpected”, 1);
end

[jan (Jan Doberstein)]

you could check if you get a return from the Lookup table in the when condition - but you can’t make a lookup and then work with the return value. You would need todo this in two rules.

First the lookup with the value added to the message and then check the value.