Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Values from the pipeline function join() on values emitted by select_jsonpath() include quotes #21233

Open
miwent opened this issue Dec 20, 2024 · 0 comments

Comments

@miwent
Copy link
Contributor

miwent commented Dec 20, 2024

Using the pipeline function join() on a value emitted by select_jsonpath() results in quote characters being included in the string value.

Expected Behavior

Quote characters are not included in the value emitted by join

Current Behavior

The string values emitted by join() include unwanted quotes when that value was emitted by select_jsonpath

Possible Solution

This issue was previously addressed with a different pipeline function, lookup_all(): #17820

Steps to Reproduce (for bugs)

Paste this rule in the rule simulator and run it to see the output:

rule "test"
when
    true
then
    let j = "{\"test_key\": [ { \"name\": \"widget_10; widget_20\" }, { \"name\": \"widget_30\" } ] }";
    let jp = parse_json ( j );
    let jf = select_jsonpath (
        json: jp,
        paths: {
            __jex: "$.test_key..name"
            }
        );
    set_fields ( jf );
    let jj = join (
        elements: $message.__jex,
        delimiter: ";"
        );
    set_field (
        field: "joined_json_text",
        value: jj
        );

    set_field (
        field: "_direct_text_assignment",
        value: [ "widget_1; widget_2", "widget_3" ]
        );
    let tj = join (
        elements: $message._direct_text_assignment,
        delimiter: ";"
        );
    set_field (
        field: "joined_direct_text",
        value: tj
        );

end

The rule simulator output on Graylog 6.1.3:
Image

Context

Diagnosing this issue was a bit tricky, and the workaround requires an additional step of removing quotes in the output of join().

Your Environment

  • Graylog Version: 6.1.3
  • Java Version:
  • OpenSearch Version:
  • MongoDB Version:
  • Operating System:
  • Browser version:
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

2 participants