Creates or drops an in-memory lookup table that can be called by the lookup command, or enumerates all the records created in the table.


To enumerate in-memory lookup tables, or to enumerate records of the specific in-memory lookup table

memlookup [op=list] [name=TABLE]

To create an in-memory lookup table (using the data received by the pipe)

memlookup op=build name=TABLE key=KEY_FIELD FIELD, ...

To drop an in-memory lookup table

memlookup op=drop name=TABLE
Required Parameter
Operation to be performed (default: list).
  • build: Builds a lookup table using the data received as input until the query command is complete.
  • drop: Drops the mapping table specified by the name option.
  • list: Enumerates in-memory lookup table, or records of the lookup table specified by the name option. If the lookup table is not created by memlookup, the query fails. If you execute the memlookup command without any option, it is the same as executing it by specifying only the op=list option.
Target table on which to run the operation specified by the op={build|drop|list} option. When op=list, if you do not specify any lookup table, the result displays the metadata of all in-memory lookup tables. The information shown here is as follows: name (lookup name), key (key field name), and size (number of records of the lookup table). This option can be omitted when op=list.
Key field name when op=build.
FIELD, ...
Field names, separated by a comma (,), to be created when op=build.


  1. Create a lookup table from a query.

    Create a lookup table named http_status with the status field as the key and desc1 and desc2 as the data field in a CSV file that has status, desc1 and desc2 columns.

    csvfile http_status.csv
    | memlookup op=build name=http_status key=status desc1, desc2
  2. Enumerate in-memory lookup tables.

    You can see the lookup table information created by memlookup. The information returned is the lookup table name, key field, and the total number of records.


    The above command has the same result as the following command.

    memlookup op=list
  3. Enumerate all records in the specified lookup table.

    If you enumerate the list by specifying the name of the lookup, you can see all the information for the lookup.

    memlookup name=http_status

    The above command has the same result as the following command.

    memlookup op=list name=http_status
  4. Drop an in-memory lookup table.

    You can drop the specified lookup table by assigning drop as the value of the operator (op) option. If you do not specify a lookup name, an error occurs.

    memlookup op=drop name=http_status