Looks up values in the specified lookup table, and assign them to fields. First, you need to load the lookup table in advance, or use the memlookup command to configure the in-memory lookup table.
lookup LOOKUP_TABLE KEY_FIELD output MAP_FIELD [as ALIAS], ...
- Lookup table to be used for field value conversion. Logpresso has a built-in
geoiplookup table, which contains the following fields: country (ISO 2-digit country code), region, city, latitude, and longitude. You can use this table to convert input field values, which are either IP address types or strings, to values in the mapping fields.
- Field name that operates as the key in the lookup table.
output MAP_FIELD [as ALIAS], ...
MAP_FIELDrefers to the name of the field to be mapped based on the key field value in the lookup table. After retrieving a record that matches the key value in the lookup table, it takes the specified field value from the lookup record and assigns it to the output field. You can use the
asclause to specify the output field name (
ALIAS) of the corresponding lookup mapping field. If you omit the clause, the mapping field name is used as it is.
Lookup the geolocation of the IP address using geoip
lookup geoip src_ip output country
lookup geoip src_ip output region
lookup geoip src_ip output city
lookup geoip src_ip output latitude, longitude