# Pipeline rule to generate a Object field with obtained IPs (multi\_value) for a QNAME, from a DNS LookUp Table

**URL:** <https://community.graylog.org/t/pipeline-rule-to-generate-a-object-field-with-obtained-ips-multi-value-for-a-qname-from-a-dns-lookup-table/14921>\
**Category:** Graylog Central (peer support)\
**Tags:** pipeline-rules, dump-messagespl, debuggingpl, sidecar, nxlog, filebeat-windows, winlogbeat, nodatanx\
**Created:** [April 10, 2020, 7:33pm UTC](https://community.graylog.org/t/pipeline-rule-to-generate-a-object-field-with-obtained-ips-multi-value-for-a-qname-from-a-dns-lookup-table/14921 "2020-04-10T19:33:43Z")\
**Posts on this page:** 1\
**Showing post:** 3

<div class="post-metadata">

**Author:** ![tmacgbay](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/tmacgbay/32/3878_2.png) [@tmacgbay](https://community.graylog.org/u/tmacgbay)\
**Post date:** [April 13, 2020, 3:59pm UTC](https://community.graylog.org/t/pipeline-rule-to-generate-a-object-field-with-obtained-ips-multi-value-for-a-qname-from-a-dns-lookup-table/14921/3 "2020-04-13T15:59:04Z")

</div>

Use [debug()](https://docs.graylog.org/en/3.2/pages/pipelines/functions.html#debug) to dump values out to the graylog log files. Maybe you are grabbing the quotes in the field data so DNS can’t work with it? You can see the results in the Graylog log file using

`tail -f /var/log/graylog-server/server.log`

ps. use the formatting tools in your posts to make the code/logs you post more readable… for instance the **\</\>** button will make

_rule “Regla Pipeline - Windows DNS Server - SilkService - Lookup DNS QNAME - MultiIP”_  
_when_  
_has\_field(“QNAME”) AND NOT contains(to\_string($message.QNAME), “[empresa.com](http://empresa.com/)”)_  
_then_  
_let multiIPs = lookup(“DNS\_QNAME\_IP”, to\_string($message.QNAME));_  
_set\_field(“QNAME\_IPs\_Prueba”, multiIPs.results);_  
_end_

Look more like

```
rule "Regla Pipeline - Windows DNS Server - SilkService - Lookup DNS QNAME - MultiIP"
when
    has_field("QNAME") AND NOT contains(to_string($message.QNAME), "[empresa.com](http://empresa.com/)")
then
    let multiIPs = lookup("DNS_QNAME_IP", to_string($message.QNAME));
    set_field("QNAME_IPs_Prueba", multiIPs.results);
end
```

---

_[View the full topic](https://community.graylog.org/t/pipeline-rule-to-generate-a-object-field-with-obtained-ips-multi-value-for-a-qname-from-a-dns-lookup-table/14921)._