Skip to main content
Version: Next

Lookup Table

An in-memory hash table with a single key column for enriching with arbitrary data.


context create  <name> lookup-table
context update <name> [--key <field>] [--erase]
context delete <name>
context reset <name>
context save <name>
context load <name>
context inspect <name>
enrich <name>
lookup <name>


A lookup-table context behaves like an ordinary table with a unique key column to be used during enrichment.

IP and Subnet Optimization

Lookup tables have one special optimization: if you use subnet values as key type, you can probe them with values of type ip to perform a longest-prefix match on all subnets. That is, the lookup table will yield the closest/narrowest match.

For example, consider a lookup table with keys and If you perform a lookup with IP address, the first subnet will match, but if you query with, the second subnet will match because it is more specific.

The following options are currently supported for the lookup-table context:

--key <field>

The field in the input that holds the unique key for the lookup table.

Defaults to the first field of the input.


When updating a lookup table, erase fields with matching keys instead of adding new entries.