# Pipeline rule to generate a Object field with obtained IPs (multi\_value) for a QNAME, from a DNS LookUp Table **URL:** \ **Category:** Graylog Central (peer support)\ **Tags:** pipeline-rules, dump-messagespl, debuggingpl, sidecar, nxlog, filebeat-windows, winlogbeat, nodatanx\ **Created:** [April 10, 2020, 7:33pm UTC](https://community.graylog.org/t/pipeline-rule-to-generate-a-object-field-with-obtained-ips-multi-value-for-a-qname-from-a-dns-lookup-table/14921 "2020-04-10T19:33:43Z")\ **Posts on this page:** 1\ **Showing post:** 6
**Author:** ![aguida79](https://avatars.discourse-cdn.com/v4/letter/a/eb8c5e/32.png) [@aguida79](https://community.graylog.org/u/aguida79)\ **Post date:** [April 13, 2020, 6:31pm UTC](https://community.graylog.org/t/pipeline-rule-to-generate-a-object-field-with-obtained-ips-multi-value-for-a-qname-from-a-dns-lookup-table/14921/6 "2020-04-13T18:31:36Z")
Hi again @tmacgbay Debugging multiIPs fields, I obtained the same output mentioned in the main post, when I say “text field that I’m generating for troubleshooting” (before you give me the hint about using the debug() function, I put the output to a common text field, “QNAME\_IPs\_Text”): ``` [root@appliance ~]# tail -f /var/log/graylog-server/server.log | grep "Debug message to review" 2020-04-13T15:23:33.953-03:00 INFO [Function] PIPELINE DEBUG: Debug message to review: {results=[ADnsAnswer{ipAddress=40.90.23.247, ipVersion=null, dnsTTL=42}, ADnsAnswer{ipAddress=40.90.137.127, ipVersion=null, dnsTTL=42}, ADnsAnswer{ipAddress=40.90.137.124, ipVersion=null, dnsTTL=42}]} 2020-04-13T15:23:33.953-03:00 INFO [Function] PIPELINE DEBUG: Debug message to review: {results=[ADnsAnswer{ipAddress=40.90.23.247, ipVersion=null, dnsTTL=51}, ADnsAnswer{ipAddress=40.90.137.127, ipVersion=null, dnsTTL=51}, ADnsAnswer{ipAddress=40.90.137.124, ipVersion=null, dnsTTL=51}]} 2020-04-13T15:23:33.954-03:00 INFO [Function] PIPELINE DEBUG: Debug message to review: {results=[ADnsAnswer{ipAddress=40.90.23.247, ipVersion=null, dnsTTL=51}, ADnsAnswer{ipAddress=40.90.137.127, ipVersion=null, dnsTTL=51}, ADnsAnswer{ipAddress=40.90.137.124, ipVersion=null, dnsTTL=51}]} 2020-04-13T15:23:33.954-03:00 INFO [Function] PIPELINE DEBUG: Debug message to review: {results=[ADnsAnswer{ipAddress=40.90.23.247, ipVersion=null, dnsTTL=51}, ADnsAnswer{ipAddress=40.90.137.127, ipVersion=null, dnsTTL=51}, ADnsAnswer{ipAddress=40.90.137.124, ipVersion=null, dnsTTL=51}]} 2020-04-13T15:23:33.955-03:00 INFO [Function] PIPELINE DEBUG: Debug message to review: {results=[ADnsAnswer{ipAddress=40.90.23.247, ipVersion=null, dnsTTL=51}, ADnsAnswer{ipAddress=40.90.137.127, ipVersion=null, dnsTTL=51}, ADnsAnswer{ipAddress=40.90.137.124, ipVersion=null, dnsTTL=51}]} 2020-04-13T15:23:33.956-03:00 INFO [Function] PIPELINE DEBUG: Debug message to review: {results=[ADnsAnswer{ipAddress=40.90.23.247, ipVersion=null, dnsTTL=42}, ADnsAnswer{ipAddress=40.90.137.127, ipVersion=null, dnsTTL=42}, ADnsAnswer{ipAddress=40.90.137.124, ipVersion=null, dnsTTL=42}]} 2020-04-13T15:23:33.981-03:00 INFO [Function] PIPELINE DEBUG: Debug message to review: {results=[ADnsAnswer{ipAddress=40.90.137.124, ipVersion=null, dnsTTL=3}, ADnsAnswer{ipAddress=40.90.23.154, ipVersion=null, dnsTTL=3}, ADnsAnswer{ipAddress=40.90.137.120, ipVersion=null, dnsTTL=3}]} ``` With that string I’m “fighting” to obtain only the IP addresses in the other post, [Pipeline rule, multiple values using regex function, only possible to return value ["0"]](https://community.graylog.org/t/pipeline-rule-multiple-values-using-regex-function-only-possible-to-return-value-0/14941), but with no luck too, ☹ Thanks for all your help! Regards, Alejandro --- _[View the full topic](https://community.graylog.org/t/pipeline-rule-to-generate-a-object-field-with-obtained-ips-multi-value-for-a-qname-from-a-dns-lookup-table/14921)._