enrich
Enriches events with a context.
Synopsis
enrich <name> [--field <field...>] [--replace] [--filter] [--separate]
[--yield <field>] [<context-options>]
enrich <output>=<name> [--field <field...>] [--filter] [--separate]
[--yield <field>] [<context-options>]
Description
The enrich
operator applies a context, extending input events with a new field
defined by the context.
<name>
The name of the context to enrich with.
<output>
The name of the field in which to store the context's enrichment. Defaults to the name of the context.
--field <field...>
A comma-separated list of fields, type extractors, or concepts to match.
--replace
Replace the given fields with their respective context, omitting all meta-information.
--filter
Filter events that do not match the context.
This option is incompatible with --replace
.
--separate
When multiple fields are provided, e.g., when using --field :ip
to enrich all
IP address fields, duplicate the event for every provided field and enrich them
individually.
When using the option, the context moves from <output>.context.<path...>
to
<output>
in the resulting event, with a new field <output>.path
containing
the enriched path.
--yield <path>
Provide a field into the context object to use as the context instead. If the
key does not exist within the context, a null
value is used instead.
<context-options>
Optional, context-specific options in the format --key value
or --flag
.
Refer to the documentation of the individual contexts for these.
Examples
Apply the lookup-table
context feodo
to suricata.flow
events, using the
dest_ip
field as the field to compare the context key against.
export
| where #schema == "suricata.flow"
| enrich feodo --field dest_ip
To return only events that have a context, use:
export
| where #schema == "suricata.flow"
| enrich feodo --field dest_ip --filter