Cribl - Docs

Getting started with Cribl LogStream

Questions? We'd love to help you! Meet us in #cribl (sign up)
Download manual as PDF




The Lookup function enriches events with external fields. CSV lookup table files are supported.


Filter: Filter expression (JS) that selects data to be fed through the function. Defaults to empty - all events will be evaluated.
Description: Simple description about this function. Defaults to empty.
Final: If true, stops data from being fed to the downstream functions. Defaults to No.

Lookup file path (.csv, .csv.gz): Path to the location of the lookup file. Environment variables can be referenced via $, e.g. $HOME/file.csv.
Match Mode: Defines the format of the lookup file an indicates the matching logic that will be performed. Defaults to Exact.
Match Type: For CIDR and Wildcard Match Mode, this attribute further refines how to resolve multiple matches. First Match will return the first matching entry, Most Specific will scan all entries finding the most specific match, and All will return all matches in output as arrays. Defaults to First Match.
Reload Period (sec): Periodically check the underlying file for modtime changes and reload if necessary. Use -1 to disable. Defaults to 60.
Add to raw event: Whether to append the looked up values to _raw field as key=value pairs. Defaults to No.

Lookup Fields (.csv): Field(s) which should be used to key into the lookup table.

  • Lookup Field Name in Event: Exact field name as it appears in events. Nested addressing supported.
  • Corresponding Field Name in Lookup: The field name as it appears in the lookup file, defaults to event field name. This input is optional.

Output field(s): Field(s) to add to events after matching the lookup table. Defaults to all if not specified.

  • Output Field Name from Lookup: Field name as it appears in the lookup file.
  • Lookup Field Name in Event: Field name to add to event, defaults to lookup field name. This input is optional. Nested addressing supported.


See Ingest-time Lookups for examples.


Suggested Edits are limited on API Reference Pages

You can only suggest edits to Markdown body content, but not to the API spec.