Reference Tables

Reference Tables store reusable CSV data for Lookup rules. Use them to enrich incoming logs with centrally managed context such as service ownership, customer tier, environment, or endpoint metadata.

Open Settings → Reference Tables to view each table's name, primary key, columns, and last update time.

Create a Reference Table

1. Click New Reference Table.
2. Enter a unique table name.
3. Paste CSV data with a header row, or upload a .csv file.
4. Optionally switch from Raw to Table to preview the parsed rows.
5. Select the column containing the unique lookup key.
6. Click Create Reference Table.

CSV column names must start with a letter or underscore and may contain letters, numbers, and underscores. Every row must have a value for every column. Primary-key values must be present and unique.

Use a Table in a Lookup Rule

In a Lookup rule:

1. Select the reference table.
2. Choose the incoming Source Field whose value should match the table's primary key.
3. Select the table columns to add as log attributes.
4. Enable Overwrite existing attributes only when lookup values should replace attributes already present on the log.

Logs without a matching row continue unchanged.

Replace or Delete Table Data

Open a table or use its actions menu to replace its CSV. Replacement CSV must keep the same columns in the same order; the primary key cannot be changed. Delete is available only when no Lookup rule uses the table.

Reference tables are shared across pipelines. Updating a table affects every Lookup rule that uses it, and pipeline-specific access restrictions do not restrict the table itself. Users need Log Pipeline write access to create, replace, or delete reference tables.

Do not use reference tables for passwords, tokens, or other secrets. Selected values are added to matching logs as searchable attributes.