Multi-Value lookup table in pipeline WHEN clause

(Bradley Kite) #1

Hi there,

Is it possible to use multi-value lookup values inside of the WHEN statement in a pipeline rule?

For example, within a THEN statement, it is possible to do this:

let geo = lookup(“geoip-lookup”, to_string($message.remote_ip));

But how can I do the same in the WHEN statement?

rule “check_last_location”
has_field(“remote_ip”) &&
lookup(“geoip-lookup”, $message.remote_ip)) ??? How to reference [“country”].iso_code
set_field(“VPN-location-unexpected”, 1);

(Jan Doberstein) #2

you could check if you get a return from the Lookup table in the when condition - but you can’t make a lookup and then work with the return value. You would need todo this in two rules.

First the lookup with the value added to the message and then check the value.

(system) #3

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.