lookup Performs live filtering of the import feed using a context ,
and translates context updates into historical queries.
Synopsis lookup <context> [--field <field...>] [--separate] [--live] [--retro] [--yield <field>] [--parallel <level>] [<context-options>] lookup <output>=<context> [--field <field...>] [--separate] [--live] [--retro] [--yield <field>] [--parallel <level>] [<context-options>]
Description The lookup
operator performs two actions simultaneously:
Translate context updates into historical queries Filter all data with a context that gets ingested into a node These two operations combined offer unified matching , i.e., automated retro
matching by turning context updates into historical queries, and live matching
with a context on the import feed.
The diagram below illustrates how the operator works:
eyJ2ZXJzaW9uIjoiMSIsImVuY29kaW5nIjoiYnN0cmluZyIsImNvbXByZXNzZWQiOnRydWUsImVuY29kZWQiOiJ4nO1daVdcIsnS/j6/wuN7zv001M2M3O83VETbXVDUd+7xIFx1MDAxNIgshcXiMqf/+43EpaqAglx1MDAwMkHpaZ053XYtWVmZXHUwMDEx8TxcdTAwMTFcdTAwMTmR9fdcdTAwMWZra+vdp7a7/p+1dfexVGzUyn7xYf1Pe7zv+p2a18JTMPh3x+v5pcGVt91uu/Off/+72G47wV1OyWu+3Ok23Kbb6nbw2v/Hf6+t/T34M/SsRq3lXHUwMDBlrlx1MDAxZFx1MDAxY1xynqS5XHUwMDE4PnrotVx1MDAwNk9cdTAwMTVcdTAwMDY0I1Kb91x1MDAwYmqdLXxS1y3j2Uqx0XGDM/bQen2nfbjL8sdX9YNcdTAwMWRTrT8+bZ+rm+CplVqjkes+NV5eqVi67fmhPnW6vld3XHUwMDBitXL3XHUwMDE2z9Oh4+/3dTx8+eAu3+tVb1tup1x1MDAxM7nHa1x1MDAxN0u17pM9Rsj70WKrOmgjOPJox5pcdTAwMTDHaC2oIVRyJk0wILZcdTAwMDFGqEOJ0GBAXHUwMDEyYyRlQz3b9Fx1MDAxYZ5ve/Z/1LX/XHUwMDA1fbsplupV7GCrXHUwMDFjXFzjXHUwMDFht+RWgmtcdTAwMWVe31x1MDAxN0L9vHVr1dsuXHUwMDFlVNrhWlOhtNLcKK6CR7uDSWDUMEJcdTAwMThcdTAwMDRvbp/X3i1cdTAwMGYk4b/ByPvFprtr72j1XHUwMDFhjfDgtcqvg1x1MDAxNzlxY09kXHUwMDAyoYqc7LXLxVx1MDAxN1x1MDAxOaCKXGJDQFx1MDAxYVx1MDAwMzzoPopaffiehleqj1x1MDAxMZtOt+h3N2qtcq1VXHUwMDFkvsVtlWPONIqd7qbXbNa62I1jr9bqXHUwMDBlXzFoN+373sOtW1x1MDAxY3ltbDn2XFzbNlx1MDAxN+iR/Vx0fltcdTAwMGJEZ/CP99//++fYq1MoWVx1MDAxMrRcdTAwMTRcdTAwMWF1SVx1MDAxMUrAhO/H6Vx1MDAwNZxWw7ngXFxcdTAwMGIuprVHhXFcYlOUccqJXHUwMDAy88HWzITWXHUwMDE4niNCUSGoXHUwMDAwJtWHuobjXHUwMDAwTDPJOMpcdFx1MDAwNVx1MDAwMlROay9uoP9cYv/988/xxq7rPnbHXHUwMDE5O2Bq+Oi7sVx1MDAxM8YwZkKaNM3YbVx1MDAxZNfvz/tcdTAwMDdy7/m5cNnYq+c6lc5JjLFcdTAwMWIyWl9m6jhzjKJcXChjuFwiSlx1MDAwNrZsYOqAOJpcYmlwXHUwMDFjQCrQXHUwMDFmsnQlt8zLxVFLZ9CoMVx1MDAxNVx1MDAxONl3a8eYI0dcclx1MDAxY0iNXCJcdTAwMTNg0FdcdTAwMTg4wSWOyjxcdTAwMDau4rW6udqznYrQcNqj28VmrTFcdTAwMTj198NcdTAwMDOxtVjtefVeez1yPN2oVa1cYq+XsMeuXHUwMDFmke5uXHJcdTAwMTnB+1x1MDAwNV0vdGtcdJ9UROj3R8fG82vVWqvYyMc81TKGnbe5oVx1MDAwZYQmu+NcdTAwMGXoXHUwMDA0vpOaqIe+W+q+SOJcdTAwMThlVHr44JsuKoWGRCqRXFxcdTAwMTfl/nW2dHbpXHUwMDEy3SW718Kkd1x1MDAxNM2sOvGgMvi3vUOE7lgotdBjqFx1MDAwNVrhYV1cdTAwMDPkP/j/srlEYOX/fv8tznaHpngrU3viW7mbXHUwMDAyKd9fsiZpZ29SpfX3637+Ob7Zl5uvsmnvMXvxXHUwMDAw1dxtt7R73tiTzZvoU96eX7TMINTuXHUwMDFi4EywXHUwMDBlijExi3WYXHUwMDBiu1x1MDAwNMSpi6YwsFAqsbqMXHUwMDFmy7nUXHUwMDA14tSl7Fl2tlj0XHUwMDEyXHUwMDBl45xcdTAwMDC+q1x1MDAwNoLQXHUwMDEwVVx1MDAxZlx1MDAwZY74kFx1MDAwMlx1MDAxNUVZV8YoXHUwMDEwJcZhlFx1MDAxYYHOXHUwMDEwzvR48Fx1MDAxMsPqRPFaSWR4Xv5x2Fx1MDAxNUzkXHUwMDFidm3i6YhcdTAwMDTPXHUwMDA2Xs1auVx1MDAxY4aLKH5Ns/PDkDbSmWFMXHUwMDEzIXlcYkBNTFTQXHUwMDE3XHUwMDAzMUZDZWiYh1RUoluJ3Dh43DRccp1ssFZcdTAwMTTQmFx1MDAxMI5cdTAwMDGGTqlSQlx1MDAwZrNLjn421yiRICSAkWqoXyFdxbEqwXxgR1x1MDAxY0HRiadSUiNcdTAwMTmESMa7qupcdTAwMTHko1x1MDAxNLtEKftqmjkrkIRGMKFcdTAwMWZcdTAwMWRg41vMKIliXHLUvtTrXGbGl1x1MDAxOUq4ocowYoRkIUdvvVps27cxOFx1MDAwN1x1MDAwNGVcdTAwMDBpvlwiOFx1MDAwN2+e6M/gNWb34Ne7fm2IS36mXHUwMDFmXHUwMDFmI1X2R8/qnsZaXHUwMDEwXHUwMDA2sSDPlZBaXHUwMDExkjxcdTAwMTiX69HHwq4+zVx1MDAxNO5cdTAwMGXVk3e13axcXDyuulx0QVx1MDAwZt1B/1x1MDAxNFmo0WA4XHUwMDBm6e/AVzLGkUppajjTSFZ1fDCuQnSJkM80XCKMIOBTtXRcdTAwMDI9JVx1MDAxOEfQki3XiHw0XHUwMDE491x1MDAwZlLlWLZcdTAwMWWKh1x1MDAwZWkyXHUwMDA1htZRqFAgeZoqP+7ldrLt0o9zfr93sn9m9u83zq5WXpVcdTAwMTWqMjCOzJlcdTAwMGJmQsHrXHUwMDAxXHUwMDFigFc2wFx1MDAxOFx1MDAxMNR0XHUwMDFkT90/osnCulxm+HDNJEd81cGrvGsyXHUwMDFm1WRcIlxiJZazfa0m499cdTAwMTBExOZj7lRGjk5g7o1a3/2r5budXlx1MDAwMzs3J3+fO/g0/uGJ+Drj86FtmI9cdTAwMGbrKFJQYSiKbmJcdTAwMWTNsPKP5kW6XFxv7va28tvtk1x1MDAxYvc2t+o6ylx1MDAwMVx1MDAxY2CE8yjKMnCUYtogZVx1MDAxZvzwoVx1MDAwZS2Gqlx1MDAwM4yJS40qoyGcUkA++bXcfG43eiXWuMZA7kJhNTSXQ9d/XGJGlY5dsEGWg2aay1x1MDAxOVx1MDAxOLH3nO5cdTAwMTTV05ne0cVSc//kLnddvl55XHUwMDE1lcpBnlwiXHUwMDEwwlx1MDAxNFBcdTAwMTOy5/Z+QEJsKKWSccJcdExA0Y9EkCl1XHUwMDA0Qe6tNFx1MDAwMcXGr96MxpOpXHUwMDAxpjnnX4yiWlxiXHUwMDExUK1lo+i/YpCz4Va6S8DNf82IlXROrFx1MDAxNCR2tVx1MDAwNrFcdTAwMTL9fGFmWK7Z9vdY5/g4f5Tj+jZbOb3JlKt81Vx1MDAxNZFpXHUwMDA3kVx1MDAxMp1w8Vx1MDAwMoo0XG6aXHUwMDE0oZRcdTAwMGJlw9LLobLULslcdTAwMWJAoVx1MDAwNm7sz1x1MDAxOK9cdTAwMTQodlx1MDAxMiRQ9trLUHj+VSmlokKB/obTVYbTXHUwMDE0dThQolx1MDAwNcfZQv9cYimYm1xuXHUwMDA0zv5cdTAwMDBVXHUwMDBl4WCsQE5rLl50XlpcdTAwMWFcdTAwMTaaXHUwMDE50TvWaoCOtVx1MDAxYZpcdHxBXG7JXHUwMDE3rc6yd95cdTAwMDHsuN5VqnJwnipu357/qK660Ugp41BcdJxGvV8hjFx1MDAwM3aJ+2U6gmyZxS78oogwI1x1MDAxNVKIWItBXHUwMDFjpVx1MDAxOfBXm0ZcdTAwMDBGLVx1MDAwNjF2rpRcdED022K8t7sqXHUwMDE2I36uXHUwMDA3t4/M8qJcYnp8xJoqqlx1MDAwNJVihjhXufMotjptka+0eOq5lnk+hMfnlVdxJlx1MDAxZKokIUwzrVx1MDAxMV5cdTAwMDMhXHUwMDFkqDrgafSwP5ZMXHUwMDE1T1xuLFIwQ3HqlaXm40jBKDNHXHUwMDExIVxiXHUwMDFjX1x1MDAxY+BayNJ0cmpeellccl576cenh7hiXHUwMDFmv1xi4lx1MDAxZZfeTYlcZtnt4TUlLbTmbIZl6ZOS77p88zR9fLhz2r1cdTAwMDB+ui3lqiso1eAgkZKUMk20XHUwMDA0XHUwMDEzxWJFXHUwMDFkdK0lUZwhMVx1MDAxNjSevb9cdTAwMTjPeYNd3FFCXHUwMDEy4ESCkDJcdTAwMTRTXHUwMDBicrKQiKGrj7ZCMsl1mFx1MDAxY72laIHQqDQxUPxu09dzprrHLp/roq99kis87Fx1MDAxN+4uXHUwMDAzicNcdTAwMGJ2LnPn4vB+293fa1x1MDAxY1x1MDAxZPcu0u1a/TF8wY+bzbtM+pQ0XHUwMDBljtJl/+Tq9NrtqLe0qJlcZkRoyflVWt/AJ1hcdTAwMGb+rajAXHUwMDEyXHUwMDE3t1x1MDAxMFxmjKYo41x1MDAxNN1xaYSG8P2cO1x1MDAwMixCKVx1MDAxNC5B6LTmkDUwKbQyXHUwMDEyXHRcdTAwMDNcdTAwMTNCyXBr2jhysNwpNUhpXGab3lx1MDAxY2Gc41x1MDAxNGpkKVx1MDAxY3tcYpHeXHUwMDE542g0VpKhbyookKntXHKiUpxcdTAwMWJQXHUwMDFhhDKRxlx1MDAxMHFcdTAwMWSwWc6AXHUwMDAyo1x1MDAxMCGnNSZw6LhcdTAwMDZcdTAwMDVcdTAwMTbJJVxyXHUwMDAyaS+tacf6KjbpjDLBmJ7eN+1cdTAwMTjJXHUwMDA1qrxBsKXAou2hV4DOXHUwMDE2XHUwMDFhXHUwMDFihsht5NR0eKqZg76gYZpTjeZK8Wh7SP6owVnnStjnTW3P0kXFhWVohjKOXYi2XHUwMDA3jtaUMFwicVxccdamvi9cbogjlEap45JcdTAwMTktpFx1MDAxOJpadEFxJozEwUOPdnpzzLHLdUwhPtlsk0hrxMFXXHUwMDE1gPCFkjldjG3flHV8XHRcblx1MDAxNk5v9F1cdTAwMTXqXHUwMDA0UHR+XHUwMDA1UZpyxaZ603g53oNdY7ZcdTAwMWVcYqSIzEWKOIgjXHUwMDAyh4DjlFx1MDAxOIbTMbVBnD6qXHUwMDExXHUwMDE30E9knIjA7lx1MDAwZlx1MDAxYUTgQCWzxVx1MDAxODh6aPymjlx1MDAxZSqlY5DcoTqhnqHERJqzooIuP7XUwIrS9OZQ+nFajVVz21xcZGpTxka9mFGocYKiqztV0cDWxCicXHSBjFXQaKFcYj7JZndcdTAwMTiDJlxuhOB8WnPGQVBVXG6HXHUwMDBm3Wm8KTK3KYbQbmyRlFx1MDAwMZtAg1x1MDAxMD/VhFx1MDAxMlx1MDAwN22PUmhDcazRSMmo1cPzRDC0YMK+LyHIK6Yqx4eWRtxGo9bujCd3XHUwMDE0yUKs+8Wxm0j01VxmXHUwMDExlvqeuVSFTu3H/d6u3N5otZ9/1Fae3SlcdTAwMTRcdTAwMDHNXHUwMDE40lx1MDAwMpxcdTAwMTUlebR8T1wiuzOo/ZJcdTAwMTGNMlx1MDAxYZ8vlITcaaldI8eTOzRcYoDjzVx1MDAxMD3YmCxcdTAwMDNr0Liycs9RxdH7XHUwMDFhjbOg6cZeylx1MDAxMP9ffXL3md7fRDWJXHUwMDBiUCBcdTAwMDWI1Vx1MDAxMOTalKA9TVx1MDAxZaDg3nmHPl48XFyVstnOnuqd3WY77VXXXHUwMDEwYMhFNNi0I27DXHUwMDA0Mur/UMpcdTAwMWRGmLJMXHUwMDA0OSNjMlZHXHUwMDEyRCq6frHVaVx1MDAxN31cdTAwMTSBcYn02uFUXHUwMDE4wYU2OqZcbmw0kVx1MDAxZSmNXHUwMDE0isQoxsrKa9CveVx1MDAxMulzXc8vVt3PjlKMPHapKfMsPlx1MDAwNccyXHUwMDA0tKQkeXCicpPfPDpM3eVN5bF0w+q0z3JPq66cKfFcdTAwMWG3Va+xWVx1MDAxMsUvu6xoXHUwMDE3seVKL1x1MDAxMYA9z/QvW+qyXHUwMDEycYF/6lx1MDAxMoGckDqgNXq16KgnVvL0aaqWOr+m3nEzf/SwfXfxY5+kV17JqXZsJiyj7DVcdTAwMGY1Wrqm0T/m2ixJx1x1MDAwN6u/XG79fG5rulx1MDAwNVx1MDAxNVx1MDAwMcBPWCNAckRcZtP6t1pcIqg1257fXXP72Lm1ilx1MDAxYq5f/Fx1MDAxY/id0IGl5vdAfL66ptpcZqpcdTAwMWVcdTAwMTPr6MahuL9o7LW2mpldxVx1MDAxZv3902xerbqOgjCO1GCzfplBXHUwMDAzXHUwMDE5JclAqIO+vqJcdTAwMTPI8WdXraG1RuDV5FfV0O96k8XVm4STzkZcdTAwMTJlQVCCT0+en/fAT1xu2f1zRVx1MDAwZXa97GP2wvvRTK+8m2uEjbBcdTAwMTiEN05tZCxaOVx1MDAwNlx1MDAwM1x1MDAxZa2JWk4uO1x1MDAxNVx1MDAxYy0y6lx1MDAwM8IrZYizo1xuPFpngl43SGV+r1V41MVq1fXX7nuu//RXq42/RlfGP1x1MDAxYnJn6NBSy1GAxEaq8JRcdTAwMGVcdTAwMTdATNPfUuP6+Fhnt47zV3fdXHLZ8DNHjfNV1182WFbRXHUwMDAw5MVURqvHgSxVf+dcdTAwMDJgoFx1MDAxY5hdUfrais9fXHUwMDAwgb80l/ZzXHUwMDEwWPH4QLMgRlx1MDAxOFxi72I1TYPZjWxcdTAwMTW8/ZNcdTAwMDfRu/KOy1x1MDAxYlx1MDAxYjnZXf39XHUwMDFmQDtcdTAwMWNcdTAwMDC9RmHDzENcdPJ2TVcqJNFGM44sW1xyb1x1MDAxZLNcdTAwMThNNlx1MDAxMq2Isp4rXHUwMDA3m1x1MDAxMTcmz2ZMxSdHr1xco4z8qlx1MDAwMay5oNh3uz2/tYZ/+d6XVX5O6cRyK0DjQ1NMMaaBzrB6Wu+c77VqJSioy+PWjfAvj4S6WHWVjSlcdTAwMDDlyqHKXGJcdTAwMWSftPqRSpZkhZ9Sc805kb/qqs9vXHUwMDAxrsuq+1x1MDAxNPExY0JtrJTOsFPnXHUwMDAzSZeuKru9U7jfSzf1U5FUXHUwMDBiK5/XIFx1MDAxODjaXHUwMDE4QpjdS4lcZm2fXHUwMDEwqvs0ltjQXHS7KX0gdJxg+4Qx2eXo01x1MDAxYfRqv3g3JalcdTAwMTH+P2/7hMnw6Vx1MDAwZkZrXHUwMDE56DlcdTAwMGZexkSJX7SlUd3zs5lW3mOHh+fdnSNvN3NZXGK9VlxcXtKAXHUwMDAx2mJlXHUwMDAwsKW/tkIyusyBXCLkXGK7jVx1MDAxMdhahXBxWLBVpcNcdTAwMDZJepJcdTAwMGKjXGJcdTAwMTnH3sDuc0w18mmbbshMKH1jVJPmYJZjM1x1MDAxOL7aRozPXHUwMDA0Klxc3j+XWz1dvbvNtHaybrqiu/7H83hcdTAwMDL3ljBpwklT4dyzXHQ73Fx1MDAxMGppfrK1+1x1MDAxOZVcdTAwMWFkeIfSOZOGXlx1MDAwNN1s5DZSxSORu0vvpzNcdTAwMWJccniS7GRU0KNcdTAwMTj1Ulx0TFx1MDAxYylQwLVcdTAwMTD4h4xcdTAwMTb8cEZe9qjSknMq8JpcdTAwMTEx547d6M1owexqXHUwMDFjTK6m/1x1MDAxNupFXG41tUVcdTAwMTiEk9CSc1ioSfyWMOhUKmA80edcdTAwMTCWLNQj4ENDkzoreM21RUFcdTAwMDRM5lx1MDAwMS46XHUwMDAxsibo7FOmJo5cdTAwMWV3xOnB4+Vx6SR/eL231UxcYk5KO1xugFx1MDAwM7O1epREtVx1MDAxNo2dg7iltKBcXICtq/5cdTAwMDanj+mxn0vfwvZtur9RyG9cdTAwMWTdeNl8o15YXHUwMDFjOFlOjOx4ZH9cdTAwMTjrOfLYolRDcfZcdTAwMTNmlX1FOuuLlP/I+s3T642ruu74tecn7yyrXHUwMDFlW0mQSStHoeNAwVZtaDa0V1xmNcjmQTFbd09UqLostM+LLSW1Wy/iNd/I9LlcdTAwMTJtlze4pGJcdTAwMWMySVx1MDAxYV9nbexeu3bL3a+X6Vx1MDAxMWCCX1x1MDAwZZhgPmCCwlx1MDAwMVx1MDAxNPbu6tnD5+bZVfNU3Ze8m4TAxFx1MDAxObVcdTAwMWKbXHUwMDBim0WpXGI63ENqi7iFLr5AP5+wyJ6n38g0l1x1MDAxZTerXbjpn5VcbqepztPWQ6nP0pv3XHUwMDBi1GOcXHUwMDA0osNcdTAwMTGb8Oe25PDRIE9Dg6LAklQjfFx1MDAxZDRcdTAwMTVub1S5erhbv6pcdTAwMWVX2Vx1MDAwMSX5615cIqdcdH0hhyE4UVx1MDAxMFJRMlx1MDAxNM5cdTAwMDLmaER0XHUwMDE0Ylx1MDAxY1x1MDAwM0bFXHUwMDE4bFwiXHUwMDBlXG6uMZKM34D/N8al5cozNVpcboWMgI6TZ4iNXHUwMDAyWCSzXHUwMDBl1SrCXHUwMDEy++Vgic1cbktTv4VF4j8oomx83ZjkdVG3u739w0z/obR7XGaPXHUwMDBmXHUwMDA3xXL/oX63OmpcdTAwMTOXlY18XHUwMDE3sVDRQeGdYXIoZUygyUHBV1x1MDAxY0dcdTAwMDNALmk1jDLiYE9cZrFcdTAwMGJutioq2Vx1MDAxNi62UNjQ8Ndcbn+t5bG5guy3nldfe82R/or07Pjnfzzu3tnvZ1x1MDAwNa/c9J+BXHUwMDFkN7Z+bNFi7Tghg0xRlFWuOCeao1xmXHUwMDExI6KRd+DcQYdP01x1MDAwMb5yzWBEXGaXziFcdTAwMTPoyC+EuYXMduPErWd2TXPz4qp/mVGF0vXCMNdIXHR2q5pxkXfFR1x1MDAxY8T3pFx1MDAwNbD7XHUwMDE4XHUwMDAwXVx1MDAwMcidIOjbue6ugPtS476/m39OmfxTPZuIQqYoU1x1MDAwZbepXFzW8Cm018NSblx1MDAxY5R/JVx1MDAxOTPMblY7XHUwMDFhw1tw5P1bpmfwi5jd0tKMXHJvKDoh95UonCzFV0CoR/DoN4i7J/hoTfzcIZhcdTAwMTCEm+RJVFx1MDAxN6K2XHKVPqRN/7pQujnKnFx1MDAxY7V3VkdvYkqHqHSoXHUwMDEw6L6+pphcdTAwMGVlU71/tGYp/HG+j9Vgh1xmXHUwMDE48l2xu8rZVZ+Uulx1MDAxY17TXHUwMDFjXHUwMDBlLjOCWImeSXJfMNt/Ps5cdTAwMTRcdTAwMGa3StXDfLqm+Wn7mdNVV2F0d1x1MDAxZG5cdTAwMDNwSLy0tlx1MDAxZqWJqDCnXG5dQftVO7u9lWLL0WSpXHUwMDFjsLtjKMntl1jH1emOpi4rqaVcdTAwMTbhcokvUWS7R1xcYEuW7Vx1MDAwN7otv1a6/atlP1x1MDAxYvMljuCEXHUwMDBlfCRj+UWDapBh+/upp+5cdJNH+lxuvMuN8mVCT1Brh9tcdTAwMWSvtCFMMDNcdTAwMTTS4HZcdTAwMWJcIoVcdTAwMWFtjCF21YiPXGLht1x1MDAxZjhcdTAwMTNnvmDk9PDaPJmsr0H6utK9855cdTAwMTeYraKHN/Fcbm1tJGJ3drXZ61x1MDAxY8wyOLNB90qEhX1+R/Dm8d5v6tx5//5gc0PRTd6Uh9ejcj7qXGJcdTAwMWG7aVx1MDAxZjPabmokbVxy9JCQW1x1MDAxMbafXHUwMDE000IpXCI/YZ37W6aTy7TWnEvCYNxyglx1MDAxOY14XHUwMDA024lcdTAwMTOEXzRtS1hcdTAwMWabVaZH8Oi3WeaunJKNXHUwMDAye1JnfqtZrFxu4p2Srd2E0GS/381cdTAwMTUn2n5JW1x0XHUwMDEyyiZcdTAwMGZjXHUwMDEzeoxcdTAwMDL/0KNq+1xyTTOpcb7R31VcdTAwMWLnt5lS44xkXHUwMDBldNXfuOwtLpwjpVx1MDAwNkrHqjGF+JiAzZtF253oa0Gzfi+R61Ap7sdilFx1MDAwZvX8PVxceqbz4HLRyeODajtJoFx0hLC7XHUwMDEya7urXHUwMDExQUdCXGZcdTAwMGL5KzZJu8NcdTAwMTLTo/xroevc31x1MDAwMj1cdTAwMDPXYlx1MDAwNFx1MDAxZG1FRj85N2BcZiY2cVx1MDAwMylcdTAwMWFHXG6R6FuRS5boXHUwMDExYPpe6F5TLL6WTGlcInjkQ69T98h9uid8u1gynbPaSTN11z6s05VcdTAwMGZQ8sH+4NwuYaNjoPhQhlx1MDAxOVx1MDAwN+7YxWTFhd2TM1xcM73QPVKIdIAow18/VTLOuo2Jb9ht3EU46+1Lism4XHLAzaOJc1x1MDAxNpM1ik9v25D81fqiL5ZM68VcImqz47RWT9i319g0XHTQMnlMstDdz5wrc5nxT1x1MDAxZdpXcHzWg3Zn5bVWg2O3fTFcdTAwMDQ1l6lwSUK0XHUwMDA01CZ0XHUwMDFiKSaUgH5AazlcdTAwMTls2StxyHHEIVlcdKj9ZFx1MDAxZKq4gWUvL4SaXHUwMDFhU1x1MDAwMMpEKFx1MDAwZuJcdTAwMTN2U/C9z1fRyEM/noWSukxX2HkjX2VcdTAwMTd33M903L3CQztcdPHljDnUXHUwMDE2XHUwMDE3WPaqw/tGXHUwMDBlXHQrt3v70DHeXHUwMDFkd7RcclxcXG6u2EDQxuyh9duR31x1MDAwNURcdTAwMTBcdTAwMTVcdTAwMDK7XHRXIYZyXHUwMDAwIf7zypJcdTAwMTn0ss1cdTAwMTKq3aRcdTAwMTSUhEV2VlJrg+6/XHUwMDFjr412Ooba/vHqx6xcdTAwMTfb7Vxc1+499vb9pPV+zX3YXHUwMDE4Y7crg1x1MDAxZutcdTAwMDVcclx1MDAxNNpKrzv47NLPP37+XHUwMDBm69XHVyJ9lookup Context live results & context updates Storage import event feed trigger query per context update return retro results results 1 2 3 hook import feed 1 enrich live feed 2 3 relay context updates retro live
<context>
The name of the context to lookup with.
<output>
The name of the field in which to store the context's enrichment.
Defaults to the name of the context.
--field <field...>
A comma-separated list of fields, type extractors, or concepts to match.
--separate
When multiple fields are provided, e.g., when using --field :ip
to enrich all
IP address fields, duplicate the event for every provided field and enrich them
individually.
When using the option, the context moves from <output>.context.<path...>
to
<output>
in the resulting event, with a new field <output>.path
containing
the enriched path.
--live
Enables live lookup for incoming events.
By default, both retro and live lookups are enabled. Specifying either --retro
or --live
explicitly disables the other.
--retro
Enables retrospective lookups for previously imported events. The lookup
operator will then apply a context after a context update .
By default, both retro and live lookups are enabled.
Specifying either --retro
or --live
explicitly disables
the other.
--yield <path>
Provide a field into the context object to use as the context instead. If the
key does not exist within the context, a null
value is used instead.
--parallel <level>
The number of partitions to open in parallel for retrospective lookups. This
number directly correlates with memory usage and performance of the lookup
operator.
Defaults to 3.
<context-options>
Optional, context-specific options in the format --key value
or --flag
.
Refer to the documentation of the individual contexts for these.
Examples Apply the context feodo
to incoming suricata.flow
events.
lookup --live feodo --field src_ip | where #schema == "suricata.flow"
Apply the context feodo
to historical suricata.flow
events with every update
to feodo
.
lookup --retro feodo --field src_ip | where #schema == "suricata.flow"
Apply the context feodo
to incoming suricata.flow
events, and also apply the
context after an update to feodo
.
lookup feodo --field src_ip | where #schema == "suricata.flow"