Pipeline rule to generate a Object field with obtained IPs (multi_value) for a QNAME, from a DNS LookUp Table

Graylog Central (peer support)
, , , , , , ,
6

Hi again @tmacgbay

Debugging multiIPs fields, I obtained the same output mentioned in the main post, when I say “text field that I’m generating for troubleshooting” (before you give me the hint about using the debug() function, I put the output to a common text field, “QNAME_IPs_Text”):

[root@appliance ~]# tail -f /var/log/graylog-server/server.log | grep "Debug message to review"
2020-04-13T15:23:33.953-03:00 INFO  [Function] PIPELINE DEBUG: Debug message to review: {results=[ADnsAnswer{ipAddress=40.90.23.247, ipVersion=null, dnsTTL=42}, ADnsAnswer{ipAddress=40.90.137.127, ipVersion=null, dnsTTL=42}, ADnsAnswer{ipAddress=40.90.137.124, ipVersion=null, dnsTTL=42}]}
2020-04-13T15:23:33.953-03:00 INFO  [Function] PIPELINE DEBUG: Debug message to review: {results=[ADnsAnswer{ipAddress=40.90.23.247, ipVersion=null, dnsTTL=51}, ADnsAnswer{ipAddress=40.90.137.127, ipVersion=null, dnsTTL=51}, ADnsAnswer{ipAddress=40.90.137.124, ipVersion=null, dnsTTL=51}]}
2020-04-13T15:23:33.954-03:00 INFO  [Function] PIPELINE DEBUG: Debug message to review: {results=[ADnsAnswer{ipAddress=40.90.23.247, ipVersion=null, dnsTTL=51}, ADnsAnswer{ipAddress=40.90.137.127, ipVersion=null, dnsTTL=51}, ADnsAnswer{ipAddress=40.90.137.124, ipVersion=null, dnsTTL=51}]}
2020-04-13T15:23:33.954-03:00 INFO  [Function] PIPELINE DEBUG: Debug message to review: {results=[ADnsAnswer{ipAddress=40.90.23.247, ipVersion=null, dnsTTL=51}, ADnsAnswer{ipAddress=40.90.137.127, ipVersion=null, dnsTTL=51}, ADnsAnswer{ipAddress=40.90.137.124, ipVersion=null, dnsTTL=51}]}
2020-04-13T15:23:33.955-03:00 INFO  [Function] PIPELINE DEBUG: Debug message to review: {results=[ADnsAnswer{ipAddress=40.90.23.247, ipVersion=null, dnsTTL=51}, ADnsAnswer{ipAddress=40.90.137.127, ipVersion=null, dnsTTL=51}, ADnsAnswer{ipAddress=40.90.137.124, ipVersion=null, dnsTTL=51}]}
2020-04-13T15:23:33.956-03:00 INFO  [Function] PIPELINE DEBUG: Debug message to review: {results=[ADnsAnswer{ipAddress=40.90.23.247, ipVersion=null, dnsTTL=42}, ADnsAnswer{ipAddress=40.90.137.127, ipVersion=null, dnsTTL=42}, ADnsAnswer{ipAddress=40.90.137.124, ipVersion=null, dnsTTL=42}]}
2020-04-13T15:23:33.981-03:00 INFO  [Function] PIPELINE DEBUG: Debug message to review: {results=[ADnsAnswer{ipAddress=40.90.137.124, ipVersion=null, dnsTTL=3}, ADnsAnswer{ipAddress=40.90.23.154, ipVersion=null, dnsTTL=3}, ADnsAnswer{ipAddress=40.90.137.120, ipVersion=null, dnsTTL=3}]}

With that string I’m “fighting” to obtain only the IP addresses in the other post, Pipeline rule, multiple values using regex function, only possible to return value ["0"], but with no luck too, :frowning:

Thanks for all your help!

Regards,
Alejandro