Complimentary Gartner® Report! 'A CTO's Guide to Open-Source Software: Answering the Top 10 FAQs.'Read more

Lookup Fields

Description

The Lookup Fields processsor can be used to add matching telemetry fields from a CSV file.

Use

The Lookup Fields processsor is used to dynamically add fields based on an existing telemetry value. For each unit of telemetry processed, this processor will grab the value of a field and perform a lookup using a CSV file. If that value exists, the processor will add all other fields associated with that CSV row.

The processor re-reads the CSV file every 60 seconds, allowing updates to be made without restarting the agent.

Supported Types

MetricsLogsTracesBindPlane Agent
v1.45.0\+

Configuration

FieldDescription
CSVThe CSV file used to perform a lookup operation.
ContextThe context of the lookup operation. The source field must exist here in order to perform a lookup. If a lookup succeeds, all matching fields are also added to this location.
FieldThe field to lookup in the specified context. A lookup operation is performed if the name and value of this field match a header and value in the CSV file.

Example Configuration(s)

Adding Fields Based on Host

In this configuration, the processor will perform a lookup on the host.name value of all incoming metrics. If this field exists on the resource of a metric and the specified CSV file contains a matching value with that header, all other fields in that CSV row will be added to the metric. For example, in this particular configuration, if a metric has a value of MacBook-Pro-4.local for host.name, the corresponding values for region and env will automatically be added to the same context.

Web Interface

observIQ docs - Lookup Fields - image 1

Example CSV

csv
1host.name,region,env
2MacBook-Pro-4.local,us-east,prod
3MacBook-Pro-3.local,us-west,dev
4MacBook-Pro-2.local,us-central,dev
5MacBook-Pro-1.local,us-central,prod