Cribl - Docs

Getting started with Cribl LogStream

Questions? We'd love to help you! Meet us in #cribl (sign up)

Changelog    Guides



The Lookup function enriches events with external kv pairs. CSV lookup table files are supported as of this version.


Filter: Filter expression (JS) that selects data to be fed through the function. Defaults to empty - all events will be evaluated.

Description: Simple description about this function. Defaults to empty.

Final: If true, stops data from being fed to the downstream functions. Defaults to No.

Lookup file path (.csv, .csv.gz): Path to the location of the lookup file. Environment variables can be referenced via $, e.g. $HOME/file.csv.

Reload Period (sec): Periodically check the underlying file for modtime changes and reload if necessary. Use -1 to disable. Defaults to 60.

Add to raw event: Whether to append the looked up values to _raw field as key=value pairs. Defaults to No.

Lookup Fields (.csv): Field(s) which should be used to key into the lookup table.

  • Lookup Field Name in Event: Exact field name as it appears in events.
  • Corresponding Field Name in Lookup: The field name as it appears in the lookup file, defaults to event field name. This input is optional.

Output field(s): Field(s) to add to events after matching the lookup table. Defaults to all if not specified.

  • Output Field Name from Lookup: Field name as it appears in the lookup file.
  • Lookup Field Name in Event: Field name to add to event, defaults to lookup field name. This input is optional.


See Ingest-time Lookups for examples.


Suggested Edits are limited on API Reference Pages

You can only suggest edits to Markdown body content, but not to the API spec.