Tor_lookup Always returns false

[ionstorm]

Please see https://github.com/Graylog2/graylog2-server/issues/4539

I can confirm, tor_lookup always fails, also when you query the dataset it does not return true when found, it returns what looks like a hash

Tor successful lookup:(not returning true)

{
  "single_value": "D83665AF257FD05C4687897815233FD52A8E9829",
  "multi_value": {
    "node_ids": [
      "D83665AF257FD05C4687897815233FD52A8E9829"
    ]
  },
  "ttl": 9223372036854776000,
  "empty": false
}

Abuse.CH successful lookup
{
  "single_value": true,
  "multi_value": {
    "value": true
  },
  "ttl": 9223372036854776000,
  "empty": false
}

[Jan Doberstein]

the lookup returns the ID of the Relay.

https://atlas.torproject.org/#details/D83665AF257FD05C4687897815233FD52A8E9829

You are right, this is not the correct as you would think it would return true or false and not the nodes ID in the Tor Network.

[ionstorm]

This could also be turned into a feature request with a new field showing the tor_url :

https://atlas.torproject.org/#details/D83665AF257FD05C4687897815233FD52A8E9829

[Jan Doberstein]

closing in favor of https://github.com/Graylog2/graylog2-server/issues/4539