The list of values can then be added to the current stream message in the pipeline. If the search is successful, the requested field(s) are returned. The slookup function constructs a search query using the value of winlogbeat_computer_name on the computer_name field ( computer_name:VALUE_OF_FIELD). The source of this data might be Directory Service Computer Objects, NBTScan results, Discovery Scan, etc. In the following examples, the remote stream named Systems with stream_id 5a5d8854315d00059dbea98f contains system information (IP, MAC, Operating System). Timestamp sort order either 'asc' or 'desc'.īelow are a couple example rules that help demonstrate how to use slookup. The field(s) to return if the query is successful.

The destination field that will be queried against. The value to query for in the remote stream. Slookup(stream, srcField, dstField, rtnField, timeRange, sortOrder) : ListĬonduct a lookup in a remote stream and return a list of field(s) values based on a matching source field. Version 2.0.0 tested to work with Graylog 2.3.2 and 2.4.0 Function Breakdown Function With features like index sets being introduced in Graylog 2.x, it is possible to use data in one stream to enrich data in another with Pipeline Processor rules. The thought behind this function is to implement a similar functionality to the VLOOKUP function in Excel. In the example above, you might want to return the computer_name and mac_address fields where the value of src_ip matches ip_address. src_ip) from internal hosts and the other stream contains information about the systems on the network such as IP address (E.g. SLookup facilitates the lookup of a local stream's field value on a remote stream field, and if it matches, returns the requested fields for enrichment in the source stream.įor example, say there are two streams, one contains some http logs with source IPs (E.g. The GrayLog Stream Lookup (SLookup) Pipeline Processor function

Graylog convert mac address