Lookup function enriches events with external kv pairs. CSV lookup table files are supported as of this version.
Filter: Filter expression (JS) that selects data to be fed through the function. Defaults to empty - all events will be evaluated.
Description: Simple description about this function. Defaults to empty.
Final: If true, stops data from being fed to the downstream functions. Defaults to
Lookup file path (.csv, .csv.gz): Path to the location of the lookup file. Environment variables can be referenced via $, e.g. $HOME/file.csv.
Match Mode: Defines the format of the lookup file an indicates the matching logic that will be performed. Defaults to
Match Type: For CIDR and Wildcard Match Mode, this attribute further refines how to resolve multiple matches.
First Match will return the first matching entry,
Most Specific will scan all entries finding the most specific match, and
All will return all matches in output as arrays. Defaults to
Reload Period (sec): Periodically check the underlying file for modtime changes and reload if necessary. Use -1 to disable. Defaults to
Add to raw event: Whether to append the looked up values to
_raw field as key=value pairs. Defaults to
Lookup Fields (.csv): Field(s) which should be used to key into the lookup table.
- Lookup Field Name in Event: Exact field name as it appears in events. Nested addressing supported.
- Corresponding Field Name in Lookup: The field name as it appears in the lookup file, defaults to event field name. This input is optional.
Output field(s): Field(s) to add to events after matching the lookup table. Defaults to all if not specified.
- Output Field Name from Lookup: Field name as it appears in the lookup file.
- Lookup Field Name in Event: Field name to add to event, defaults to lookup field name. This input is optional. Nested addressing supported.
See Ingest-time Lookups for examples.