Hi,
After days trying to get this working, I think that I need help, :’(
Basically, I have this:
- Microsoft DNS Server Logs, collected with SilkETW, shipped with Winlogbeat and parsed as json, with parse_json, select_jsonpath, and key_value functions in a pipeline rule (this is working ok):
rule “Regla Pipeline - Windows DNS Server - SilkService - Extrae campos JSON del campo event_data_param1”
when
has_field(“event_data_param1”)
then
let json = parse_json(to_string($message.event_data_param1));
set_fields(to_map(json));
let json_fields = select_jsonpath(json, {json_XmlEventData: “$.XmlEventData”});
set_fields(json_fields);
let json_nested_fields = select_jsonpath(json, {json_FormattedMessage: “$.XmlEventData.FormattedMessage”});
let kv_fields = to_string(json_nested_fields);
set_fields(key_value(value: kv_fields, trim_value_chars: “;”));
end
-
One of the parsed fields, named QNAME, with contains the DNS LookUp Qualified Name, from which I’m trying to get mutiple resolved IP address corresponding to it, using a DNS LookUp Table.
-
Using the single_value response of the DNS LookUp Table to generate QNAME_IP field is working ok, both using extractor or pipeline rule, but I want the multi_value response, specifically the IP addresses, and at my understanding, that can only be obtained/used with a pileline rule, not a extractor.
Here is a example:
My pipeline rule:
rule “Regla Pipeline - Windows DNS Server - SilkService - Lookup DNS QNAME”
when
has_field(“QNAME”) AND NOT contains(to_string($message.QNAME), “empresa.com”)
then
let lookup_IPs_json = lookup(“DNS_QNAME_IP”, to_string($message.QNAME));
// Text variable for testing
set_field(“QNAME_TEXT”,to_string(lookup_IPs_json));
//
let QNAME_IPs = select_jsonpath(parse_json(to_string(lookup_IPs_json)), { ip_address: “$.results[*].ip_address”});
set_field(“QNAME_IPs”, QNAME_IPs);
end
With that rule, QNAME_IPs is always null.
For the JSonPath of the rule, I already tried with no luck (helped me with Json Path Online Evalutator from http://jsonpath.com):
- $.results[*].ip_address
- $.multi_value.results[*].ip_address
- $.results.ip_address
- $.string_list_value
The strange thing here, at least for me, is that the text field that I’m generating for troubleshooting, have this text (for the example above):
{results=[ADnsAnswer{ipAddress=35.163.157.37, ipVersion=null, dnsTTL=47}, ADnsAnswer{ipAddress=35.164.39.71, ipVersion=null, dnsTTL=47}]}
What I Finally need as a result, is to populate and Object field, named QNAME_IPs, with this (for the example above):
[ “35.163.157.37”, “35.164.39.71” ]
Other strange thing (again, at least for me), is that sometimes, using different DNS Servers configured in the DNS LookUp Table for troubleshooing, the lookup for a QNAME brings my a single IP, duplicated, but when I retry the lookup, is OK:
I can think that this last problem is maybe a DNS Server problem, but how is it happening configuring different DNS Servers (from my work, public) in the DNS LookUp Table in different times, maybe it is a bug in the DNS Lookup Table Adapter of Graylog.
Can anybody try to explain my what I’m doing wrong with my pipeline rule?
Thanks in advance for your help.
Regards,
Alejandro
