Stream Lookup function for GrayLog2 Pipeline Processor
SLookup facilitates the lookup of a local stream’s field value on a remote stream field, and if it matches, returns the requested fields for enrichment in the source stream.
For example, say there are two streams, one contains some http logs with source IPs (E.g.
src_ip ) from internal hosts and the other stream contains information about the systems on the network such as IP address (E.g.
ip_address ), computer name (E.g.
computer_name ), MAC address (E.g.
mac_address ), OU, make/model, etc.
In the example above, you might want to return the
mac_address fields where the value of
The thought behind this function is to implement a similar functionality to the VLOOKUP function in Excel.
With features like index sets being introduced in Graylog 2.x, it is possible to use data in one stream to enrich data in another with Pipeline Processor rules.
Version 2.0.0 tested to work with Graylog 2.3.2 and 2.4.0