Troubleshooting Data Lookups

Is there a proper way to troubleshoot what Graylog finds out from a Data Lookup? Graylog seems to return nothing when I run the test lookup, but the same query when run in a browser returns data:

[{"cn": "test-pc","dn":"cn=test-pc,dc=test,dc=domain,dc=local"}]

Data Lookup config:

Lookup URL: http://api.test.domain.local/api/v1/computers?q=cn:${key}&match=wildcard
Single value: $[0].cn
Multi value: $

I’ve tried a variety of different values for single value, the answer for single_value and multi_value is always ‘null’

EDIT: This might be because the URL requires authorization - are there any options to support authorization with Graylog Data Lookups?

Hi!

I’ve just tried this locally and it works as expected:

The only difference is that I’m not using the ${key} in the URL, since I’m just serving a static file from /tmp.
Could the issue be an encoding problem, IOW are there any non-URL safe characters in the keys you are looking up?

That’s currently not supported.

Just saw your edit.
Apparently there is a problem with basic auth, by passing the username and password in the URL template.
I naively assumed it would work.

Could you open a bug report on https://github.com/Graylog2/graylog2-server/issues please?

Thanks!

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.