Pipeline rule to generate a Object field with obtained IPs (multi_value) for a QNAME, from a DNS LookUp Table

Graylog Central (peer support)
, , , , , , ,
3

Use debug() to dump values out to the graylog log files. Maybe you are grabbing the quotes in the field data so DNS can’t work with it? You can see the results in the Graylog log file using

tail -f /var/log/graylog-server/server.log

ps. use the formatting tools in your posts to make the code/logs you post more readable… for instance the </> button will make

rule “Regla Pipeline - Windows DNS Server - SilkService - Lookup DNS QNAME - MultiIP”
when
has_field(“QNAME”) AND NOT contains(to_string($message.QNAME), “empresa.com”)
then
let multiIPs = lookup(“DNS_QNAME_IP”, to_string($message.QNAME));
set_field(“QNAME_IPs_Prueba”, multiIPs.results);
end

Look more like

rule "Regla Pipeline - Windows DNS Server - SilkService - Lookup DNS QNAME - MultiIP"
when
    has_field("QNAME") AND NOT contains(to_string($message.QNAME), "[empresa.com](http://empresa.com/)")
then
    let multiIPs = lookup("DNS_QNAME_IP", to_string($message.QNAME));
    set_field("QNAME_IPs_Prueba", multiIPs.results);
end