Hi,
I am trying to setup a pipeline rule to get some additional geo information, as described in http://docs.graylog.org/en/3.0/pages/geolocation.html#.
The problem I am facing is that part of the result of the lookup can be empty.
In the below code for the rule setting the country code works fine, but the fields which depend on the subdivisions object can lead to the error
"For rule 'rule geoip lookup': In call to function 'set_field' at 7:2 an exception was thrown: Index: 0, Size: 0".
This happens because the subdivisions object is sometimes empty, for instance:
...
"country": {
"confidence": null,
"geoname_id": 1605651,
"is_in_european_union": false,
"iso_code": "TH",
"names": {
"de": "Thailand",
"ru": "Тайланд",
"pt-BR": "Tailândia",
"ja": "タイ王国",
"en": "Thailand",
"fr": "ThaĂŻlande",
"zh-CN": "ćł°ĺ›˝",
"es": "Tailandia"
}
},
...
"subdivisions": []
Code for the rule:
rule "rule geoip subdivision lookup"
when
has_field("IP")
then
let geo = lookup("geoip-lookup", to_string($message.IP));
set_field("IP_country_code", geo["country"].iso_code);
set_field("IP_region_code", geo["subdivisions"].[0].iso_code);
set_field("IP_region_name", geo["subdivisions"].[0].names.en);
end
How can I only set the fiels IP_region_code and IP_region_name, when the array is not empty? Is it possible to use the functions “is_list” or “is_null”/“is_not_null” for this?