lookup

Looks up values in the specified lookup table, and assign them to fields. First, you need to load the lookup table in advance, or use the memlookup command to configure the in-memory lookup table.

Syntax

lookup LOOKUP_TABLE KEY_FIELD output MAP_FIELD [as ALIAS], ...
Required Parameter
LOOKUP_TABLE
Lookup table to be used for field value conversion. Logpresso has a built-in geoip lookup table, which contains the following fields: country (ISO 2-digit country code), region, city, latitude, and longitude. You can use this table to convert input field values, which are either IP address types or strings, to values in the mapping fields.
KEY_FIELD
Field name that operates as the key in the lookup table.
output MAP_FIELD [as ALIAS], ...
MAP_FIELD refers to the name of the field to be mapped based on the key field value in the lookup table. After retrieving a record that matches the key value in the lookup table, it takes the specified field value from the lookup record and assigns it to the output field. You can use the as clause to specify the output field name (ALIAS) of the corresponding lookup mapping field. If you omit the clause, the mapping field name is used as it is.

Usage

Lookup the geolocation of the IP address using geoip

lookup geoip src_ip output country
lookup geoip src_ip output region
lookup geoip src_ip output city
lookup geoip src_ip output latitude, longitude