lookup

Looks up values in the specified lookup table, and assign them to fields.

First, you need to load the lookup table in advance, or use the memlookup command to configure the in-memory lookup table.

Syntax

lookup LOOKUP_TABLE KEY_FIELD output MAP_FIELD [as ALIAS], ...
Required Parameters
LOOKUP_TABLE
Lookup table to be used for field value conversion.
KEY_FIELD
Field name that operates as the key in the lookup table.
output MAP_FIELD [as ALIAS], ...
MAP_FIELD refers to the name of the field to be mapped based on the key field value in the mapping table. After retrieving a record that matches the key value in the lookup table, it takes the specified field value from the lookup record and assigns it to the output field. You can use the as clause to specify the output field name of the corresponding lookup mapping field. If you omit the clause, the mapping field name is used as it is.

Usage

Lookup the geolocation of the IP address using geoip.

The geoip lookup table contains country (ISO two-letter country code), region, city, latitude, and longitude fields. You can use this table to convert an input field value of either an IP address type or string into the value of the mapping fields.

lookup geoip src_ip output country
lookup geoip src_ip output region
lookup geoip src_ip output city
lookup geoip src_ip output latitude, longitude