Lookup
The Lookup rule enriches logs with values from a managed Reference Table.
When to Use
- Map an internal identifier to an owner, tier, region, or other business context.
- Add centrally managed metadata without changing application logging.
- Keep enrichment values consistent across multiple pipelines.
Fields
| Field | Required | Description |
|---|---|---|
| Name | Yes | Rule identifier |
| Reference Table | Yes | Table used for matching and enrichment |
| Source Field | Yes | Incoming attribute matched against the table's primary key |
| Attributes to Add | Yes | Reference-table columns copied onto matching logs |
| Overwrite existing attributes | No | Replace existing attributes with lookup values when names collide |
Logs with no matching reference-table row pass through unchanged. Reference tables are shared resources, so changing a table affects every pipeline that uses it. See Reference Tables for CSV requirements and management behavior.