Pipeline rule to generate a Object field with obtained IPs (multi_value) for a QNAME, from a DNS LookUp Table

Graylog Central (peer support)
, , , , , , ,
11

Spent too long on this, here is what I came up with:

let lookup_IPs_json = parse_json(to_string(lookup("DNS_QNAME_IP", to_string(message.QNAME))));
debug(concat("Initial json: ", to_string(lookup_IPs_json)));

let the_ips = select_jsonpath(json: lookup_IPs_json, paths: { QNAME_IP: "$['string list value']" });
debug(concat("Set to fields: ", to_string(the_ips)));

set_fields(the_ips);