# Still my pipeline is not working - And need help badly **URL:** \ **Category:** Graylog Central (peer support)\ **Tags:** pipeline-rules, debuggingpl\ **Created:** [September 19, 2019, 3:19am UTC](https://community.graylog.org/t/still-my-pipeline-is-not-working-and-need-help-badly/12020 "2019-09-19T03:19:27Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![blason](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/blason/32/2930_2.png) [@blason](https://community.graylog.org/u/blason)\ **Post date:** [September 19, 2019, 3:19am UTC](https://community.graylog.org/t/still-my-pipeline-is-not-working-and-need-help-badly/12020/1 "2019-09-19T03:19:27Z")
Hi Team, Pertaining to my other thread since that one is closed I need to open a new one. > [@My pipiline and rules are not working as expected, can someone pls help?](https://community.graylog.org/t/my-pipiline-and-rules-are-not-working-as-expected-can-someone-pls-help/11779): > > Hi team, I need a help with debugging pipeline, can someone please help? My scenario is like below I have 2 DNS servers one is acting as a sinkhole [192.168.10.10] and other is AD.192.168.10.20] User query to AD and those queries are forwarded to a sinkhole server. 192.168.10.10 logs are being ingested using logstash while on AD I have installed packetbeat and ingesting DNS logs. AD logs are in Adlog streams while sinkhole logs are in sinkhole stream. However, I need to find the original cli… Here is the info ```auto DNS RPZ Stream Stream ID = 5b9e7dfdc4445a03714dfd72 Field = qdomain String = sway.office.com *********** AD logs Stream => Remote stream Stream ID = 5d7f8e434980dd02c2fffb34 Field = packetbeat_dns_question_name String = packetbeat_client_ip ``` As per above, I need to find out if qdomain Field from stream [5b9e7dfdc4445a03714dfd72] matches with packetbeat\_dns\_question\_name from [5d7f8e434980dd02c2fffb34] then return recent packetbeat\_client\_ip from [5d7f8e434980dd02c2fffb34] Here is my rule ```auto rule "find_orig_client_ip - new" when has_field ("qdomain") then let orig_client_ip = slookup("5d7f8e434980dd02c2fffb34", "qdomain", "packetbeat_dns_question_name", ["packetbeat_client_ip"], "180", "desc"); set_field("packetbeat_client_ip", to_string(orig_client_ip)); end ``` I am not able to get the proper results. My queries are - I am attaching this pipeline to DNS RPZ stream [5b9e7dfdc4445a03714dfd72] so per slookup help Remote stream =\> 5d7f8e434980dd02c2fffb34 srcField =\> qdomain dstField =\> packetbeat\_dns\_question\_name rtnField =\> packetbeat\_client\_ip Please help TIA blason R ---
**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\ **Post date:** [September 20, 2019, 12:32pm UTC](https://community.graylog.org/t/still-my-pipeline-is-not-working-and-need-help-badly/12020/2 "2019-09-20T12:32:06Z")
you might want to get in contact with the creator of the slookup plugin if that works like you try to use it? ---
**Author:** ![blason](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/blason/32/2930_2.png) [@blason](https://community.graylog.org/u/blason)\ **Post date:** [September 20, 2019, 1:51pm UTC](https://community.graylog.org/t/still-my-pipeline-is-not-working-and-need-help-badly/12020/3 "2019-09-20T13:51:26Z")
Agree!! and let me do that. BTW is there any alternative method that you are aware of to achieve the same in Graylog? ---
**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\ **Post date:** [September 20, 2019, 2:00pm UTC](https://community.graylog.org/t/still-my-pipeline-is-not-working-and-need-help-badly/12020/4 "2019-09-20T14:00:29Z")
no known option - at least for me. ---
**Author:** ![BlueTeamNinja](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/blueteamninja/32/11535_2.png) [@BlueTeamNinja](https://community.graylog.org/u/BlueTeamNinja)\ **Post date:** [September 20, 2019, 3:37pm UTC](https://community.graylog.org/t/still-my-pipeline-is-not-working-and-need-help-badly/12020/5 "2019-09-20T15:37:52Z")
You could loop back into graylog with a python or powershell micro-service. I do it with AD lookups, nothing says you couldn’t do it by circling back to graylog. Basically: Python (bottle is super easy) listening at http://some\_server/dns\_loopback?client=XYZ Python does a curl search on graylog and spits out the result. Set up a lookup table using the url - and carefully monitor performance and watch for loops. 🙂 ---
**Author:** ![blason](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/blason/32/2930_2.png) [@blason](https://community.graylog.org/u/blason)\ **Post date:** [September 21, 2019, 8:55am UTC](https://community.graylog.org/t/still-my-pipeline-is-not-working-and-need-help-badly/12020/6 "2019-09-21T08:55:45Z")
nah that is not gonna work for me since 1. I am not python pro 2. The DNS query rate is pretty high and not sure if that would sustatin the load. ---
**Author:** ![BlueTeamNinja](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/blueteamninja/32/11535_2.png) [@BlueTeamNinja](https://community.graylog.org/u/BlueTeamNinja)\ **Post date:** [September 30, 2019, 2:20pm UTC](https://community.graylog.org/t/still-my-pipeline-is-not-working-and-need-help-badly/12020/7 "2019-09-30T14:20:05Z")
You could do it in powershell as well. I think a custom solution is the only thing that’s going to do what you’re asking. It seems like an extremely odd request - though. What, specifically, are you trying to do - maybe there is a better option, logically? I really don’t follow your architecture. You want the original Client IP from a DNS query to a sinkhole server, right? Is it not in the DNS logs on the sinkhole server? It should be. Are you trying to find the DNS logs that are querying for invalid domains or only valid ones? Look at the DNS respones in the same stream. Does your lookup logic break if two different machines query the same domain (internal.corp or whatever?) I mean, you’re trying to match a DNS query to another log source - using the queried domain as your unique key - that seems easily broken. What is the end goal of this? Maybe draw me a picture, I’m a manager after all - I need crayons and glitter. ---
**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\ **Post date:** [October 14, 2019, 2:20pm UTC](https://community.graylog.org/t/still-my-pipeline-is-not-working-and-need-help-badly/12020/8 "2019-10-14T14:20:21Z")
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.