Graylog2 / Graylog2/graylog2-server
Lookup tables / Data Adapters: DNS Lookup for TXT records
- Dominant language
- Java
- Stars
- 8.1k
- Forks
- 1.1k
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 217
Description
When configuring a lookup table for DNS TXT records the multi_value result is effectively unusable
## Expected Behavior
According to the documentation within the online interface the result for such a lookup should be something like:
```
{
"single_value": null,
"multi_value": {
"results": [
{
"value": "Some text value that lives in a TXT DNS",
"dns_ttl": 300
},
{
"value": "v=spf1 include:some-email-domain.org ~all.",
"dns_ttl": 200
}
]
},
"ttl": 200000
}
```
## Current Behavior
Currently a lookup results in a multi_value with a key of "raw_results" instead of "results", making it unusable in pipelines when using the lookup() function because that functions seems to expect a "results" field.
```
{
"single_value": null,
"multi_value": {
"raw_results": [
{
"value": "Some text value that lives in a TXT DNS",
"dns_ttl": 300
},
{
"value": "v=spf1 include:some-email-domain.org ~all.",
"dns_ttl": 200
}
]
},
"ttl": 200000
}
```
## Possible Solution
Maybe?
```
diff --git a/graylog2-server/src/main/java/org/graylog2/lookup/adapters/DnsLookupDataAdapter.java b/graylog2-server/src/main/java/org/graylog2/lookup/adapters/DnsLookupDataAdapter.java
index 684a792e4..2a072bd07 100644
--- a/graylog2-server/src/main/java/org/graylog2/lookup/adapters/DnsLookupDataAdapter.java
+++ b/graylog2-server/src/main/java/org/graylog2/lookup/adapters/DnsLookupDataAdapter.java
@@ -358,7 +358,7 @@ public class DnsLookupDataAdapter extends LookupDataAdapter {
if (CollectionUtils.isNotEmpty(txtDnsAnswers)) {
final LookupResult.Builder builder = LookupResult.builder();
- builder.multiValue(Collections.singletonMap(RAW_RESULTS_FIELD, txtDnsAnswers))
+ builder.multiValue(Collections.singletonMap(RESULTS_FIELD, txtDnsAnswers))
.stringListValue(TxtDnsAnswer.convertToStringListValue(txtDnsAnswers));
assignMinimumTTL(txtDnsAnswers, builder);
```
## Steps to Reproduce (for bugs)
1. Create a Data Adapter with Data Adapter Type "DNS Lookup"
2. Choose DNS Lookup Type to be "Text Lookup (TXT)" and fill out all other fields
3. Create a Lookup Table using the newly added adapter
4. Do a test lookup for any TXT DNS record (I assume something like gmail.com should work)
## Context
I want to use this to add additional information for other DNS based (read RBL-style) decisions done in a pipeline. If I misinterpret anything I would be grateful to have this pointed out...
## Your Environment
* Graylog Version: 3.1.3 but current source seems to have the problem as well
* Elasticsearch Version: NA
* MongoDB Version: NA
* Operating System: Ubuntu Server
* Browser version: NA
Contributor guide
Assessment
This issue has not been assessed yet.