Multivalue pipeline rule not working

Templates and Rules Exchange Pipeline Rules
1

Graylog pipeline rule: Lookup multi-value fields not populating

I currently have the following pipeline rule which does a multi field lookup:

rule "Network  VPN Enrich"
when
contains(
value: to_string($message."Network_EventName"),
search: "SSL"
)
OR
contains(
value: to_string($message."Network_EventName"),
search: "VPN"
)
then
rename_field(
old_field : "srcip",
new_field : "VPN_SRC_IP"
);
let output_2 = lookup(
lookup_table : "geolookup",
key : "VPN_SRC_IP"
);
end

“The rule basically looks up a multi-value field using VPN SRC_IP. The ‘geolookup’ lookup table returns:”

{
  "single_value": "29.7212,-95.3626",
  "multi_value": {
    "continent": {
      "code": "NA",
      "geoname_id": 6255149,
      "names": {
        "pt-BR": "América do Norte",
        "ja": "北アメリカ",
        "ru": "Северная Америка",
        "de": "Nordamerika",
        "es": "Norteamérica",
        "fr": "Amérique du Nord",
        "zh-CN": "北美洲",
        "en": "North America"
      }
    },
    "country": {
      "confidence": null,
      "geoname_id": 6252001,
      "is_in_european_union": false,
      "iso_code": "US",
      "names": {
        "pt-BR": "EUA",
        "ja": "アメリカ",
        "ru": "США",
        "de": "USA",
        "es": "Estados Unidos",
        "fr": "États-Unis",
        "zh-CN": "美国",
        "en": "United States"
      }
    },
    "traits": {
      "autonomous_system_number": null,
      "autonomous_system_organization": null,
      "connection_type": null,
      "domain": null,
      "ip_address": "168.5.20.120",
      "is_anonymous": false,
      "is_anonymous_vpn": false,
      "is_anycast": false,
      "is_hosting_provider": false,
      "is_legitimate_proxy": false,
      "is_public_proxy": false,
      "is_residential_proxy": false,
      "is_tor_exit_node": false,
      "ip_risk_snapshot": null,
      "isp": null,
      "mobile_country_code": null,
      "mobile_network_code": null,
      "network": "168.5.16.0/20",
      "organization": null,
      "user_type": null,
      "user_count": null,
      "static_ip_score": null
    },
    "city": {
      "confidence": null,
      "geoname_id": 4699066,
      "names": {
        "en": "Houston",
        "zh-CN": "休斯敦",
        "fr": "Houston",
        "ja": "ヒューストン",
        "ru": "Хьюстон",
        "pt-BR": "Houston",
        "de": "Houston"
      }
    },
    "represented_country": {
      "confidence": null,
      "geoname_id": null,
      "is_in_european_union": false,
      "iso_code": null,
      "names": {},
      "type": null
    },
    "coordinates": "29.7212,-95.3626",
    "location": {
      "accuracy_radius": 20,
      "average_income": null,
      "latitude": 29.7212,
      "longitude": -95.3626,
      "population_density": null,
      "time_zone": "America/Chicago"
    },
    "postal": {
      "code": "77004",
      "confidence": null
    },
    "registered_country": {
      "confidence": null,
      "geoname_id": 6252001,
      "is_in_european_union": false,
      "iso_code": "US",
      "names": {
        "pt-BR": "EUA",
        "ja": "アメリカ",
        "ru": "США",
        "de": "USA",
        "es": "Estados Unidos",
        "fr": "États-Unis",
        "zh-CN": "美国",
        "en": "United States"
      }
    },
    "subdivisions": [
      {
        "confidence": null,
        "geoname_id": 4736286,
        "iso_code": "TX",
        "names": {
          "pt-BR": "Texas",
          "ja": "テキサス州",
          "ru": "Техас",
          "de": "Texas",
          "es": "Texas",
          "fr": "Texas",
          "zh-CN": "得克萨斯州",
          "en": "Texas"
        }
      }
    ]
  },
  "string_list_value": null,
  "has_error": false,
  "ttl": 9223372036854775807
}

For some reason the multi value fields are not populating from the pipeline testing:

Actions Output
$output_2: {“value”:null}
Is there something I missing?

2

hey @JulianDrums

Try the below, where instead of passing the literal value of VPN_SRC_IP you are instead passing the field value via $message.VPN_SRC_IP.

rule “Network VPN Enrich”
when
contains(
value: to_string($message.“Network_EventName”),
search: “SSL”
)
OR
contains(
value: to_string($message.“Network_EventName”),
search: “VPN”
)
then
rename_field(
old_field : “srcip”,
new_field : “VPN_SRC_IP”
);
let output_2 = lookup(
lookup_table : “geolookup”,
key : “$message.VPN_SRC_IP”
);
end

3

to me it looks, like the variable “output_2” is never saved to some field? It is filles by the lookup, but not saved.

4

That’s also true, to set specific values from the lookup try something similar to the below format.

set_field("VPN_SRC_city", output_2.city.names.en);

5

Perfect, thanks guys!

1 Like