Lookup function enriches events with external kv pairs. CSV lookup table files are supported as of this version.
Filter: Filter expression (JS) that selects data to be fed through the function. Defaults to empty - all events will be evaluated.
Lookup file path (.csv, .csv.gz): Path to the location of the lookup file. Environment variables can be referenced via $, e.g. $HOME/file.csv.
Reload Period (sec): Periodically check the underlying file for modtime changes and reload if necessary. Use -1 to disable. Defaults to
Add to raw event: Whether to append the looked up values to
_raw field as key=value pairs. Defaults to
- Lookup Field Name in Event: Exact field name as it appears in events.
- Corresponding Field Name in Lookup: The field name as it appears in the lookup file, defaults to event field name. This input is optional.
Output field(s): Field(s) to add to events after matching the lookup table. Defaults to all if not specified.
- Output Field Name from Lookup: Field name as it appears in the lookup file.
- Lookup Field Name in Event: Field name to add to event, defaults to lookup field name. This input is optional.
See Ingest-time Lookups for examples.