memlookup

Creates, queries, or drops an in-memory mapping table using query results. The created in-memory mapping table can be queried by the lookup command.

Command properties

Syntax

To list in-memory mapping tables:

To query the data in a specific in-memory mapping table:

To create an in-memory mapping table:

To drop an in-memory mapping table:

Options

op={list|build|drop}

Operation to perform. (Default: list)

• list: Lists in-memory mapping tables, or if name is specified, queries the data in that mapping table.
• build: Creates an in-memory mapping table using input records passed from the previous stage.
• drop: Drops the specified in-memory mapping table.

name=STR

Name of the in-memory mapping table. Required for build and drop operations.

key=STR

Name of the key field for the mapping table. Required for the build operation.

Target

[FIELD, ...]

List of fields to store in the mapping table for the build operation. Separate multiple fields with commas (,).

Output fields

When op=list without specifying name:

When op=list with name specified, outputs all fields stored in that mapping table.

Error codes

Parse errors

Runtime errors

Description

The memlookup command creates and manages in-memory mapping tables using query results. The created mapping table can be used with the lookup command in the same way as a regular mapping table.

When op=list without specifying name, it acts as a driver query and outputs the metadata of all in-memory mapping tables. When name is specified, it outputs all data in that mapping table.

When op=build, it acts as a transforming query. It constructs the mapping table based on the key field value of input records from the previous stage. Records where the key field value is null are ignored. If the same key appears multiple times, only the first record is stored. The maximum number of records that can be stored in a mapping table is 100,000. If the query is cancelled, the mapping table is not registered. If an in-memory mapping table with the same name already exists, it is overwritten.

When op=drop, it drops the specified in-memory mapping table at query start. If the target does not exist or is not an in-memory mapping table, the operation is ignored.

Examples

1. List in-memory mapping tables

   memlookup
   

   Outputs the name, key field, and record count of all registered in-memory mapping tables.

2. Create an in-memory mapping table

   json "[{'ip': '192.0.2.1', 'hostname': 'web-01', 'zone': 'dmz'}, {'ip': '192.0.2.2', 'hostname': 'db-01', 'zone': 'internal'}]"
   | memlookup op=build name=ip_hosts key=ip hostname, zone
   

   Creates an ip_hosts in-memory mapping table with ip as the key and including the hostname and zone fields.

3. Query data in an in-memory mapping table

   memlookup op=list name=ip_hosts
   

   Outputs all records stored in the ip_hosts in-memory mapping table.

4. Use an in-memory mapping table with lookup

   json "[{'src_ip': '192.0.2.1'}, {'src_ip': '192.0.2.2'}]"
   | lookup ip_hosts src_ip as ip output hostname
   

   Queries the ip_hosts mapping table created with memlookup using the lookup command.

5. Drop an in-memory mapping table

   memlookup op=drop name=ip_hosts
   

   Drops the ip_hosts in-memory mapping table.