Graylog2 / Graylog2/graylog2-server

Values from the pipeline function join() on values emitted by select_jsonpath() include quotes

Open
#21,233 0 comments 0 reactions 0 assignees View on GitHub
bug triaged
Dominant language
Java
Stars
8.1k
Forks
1.1k
Avg merge
1d 20h
Merged PRs (30d)
217

Description

Using the pipeline function join() on a value emitted by select_jsonpath() results in quote characters being included in the string value.

## Expected Behavior

Quote characters are not included in the value emitted by join

## Current Behavior

The string values emitted by join() include unwanted quotes when that value was emitted by `select_jsonpath`

## Possible Solution

This issue was previously addressed with a different pipeline function, lookup_all(): https://github.com/Graylog2/graylog2-server/pull/17820

## Steps to Reproduce (for bugs)

Paste this rule in the rule simulator and run it to see the output:

```unset
rule "test"
when
true
then
let j = "{\"test_key\": [ { \"name\": \"widget_10; widget_20\" }, { \"name\": \"widget_30\" } ] }";
let jp = parse_json ( j );
let jf = select_jsonpath (
json: jp,
paths: {
__jex: "$.test_key..name"
}
);
set_fields ( jf );
let jj = join (
elements: $message.__jex,
delimiter: ";"
);
set_field (
field: "joined_json_text",
value: jj
);

set_field (
field: "_direct_text_assignment",
value: [ "widget_1; widget_2", "widget_3" ]
);
let tj = join (
elements: $message._direct_text_assignment,
delimiter: ";"
);
set_field (
field: "joined_direct_text",
value: tj
);

end
```

The rule simulator output on Graylog 6.1.3:
![Image](https://github.com/user-attachments/assets/4340e677-cfe2-4e4b-8ec1-c403a321b01b)

## Context

Diagnosing this issue was a bit tricky, and the workaround requires an additional step of removing quotes in the output of join().

## Your Environment

* Graylog Version: 6.1.3
* Java Version:
* OpenSearch Version:
* MongoDB Version:
* Operating System:
* Browser version:

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.