Lookup table third field

Hello! How I can add third field with lookup tables?
Example csv:
‘first’;‘second’;‘third’
‘aa’;‘ss’;‘t1’
‘zz’;‘xx’;‘t1’
‘ff’;‘cc’;‘t1’
‘11’;‘22’;‘t2’
‘12’;‘13’;‘t2’

And I need for first three lanes, add field ‘third’ with value ‘t1’ and etc.

Hello,
I’m not sure what you mean by adding a third field.

Could you explain in more detail about this.
Thanks

Hi! Look…in basic lookup table I can create second field when find first value from csv…and…can I in somewhere add third field by this csv file? ex.: if I found in column name ‘first’ with value ‘abc’ add second field ‘second’ with value ‘blabla’ and third field ‘third’ with else one value =)) I hope I could explain)

@hudojnick
Hello,

I’m confused, a basic lookup table?
Are you referring to this?

What version of Graylog are you using?

What you don’t understand? I need somehow add else third field…

Do you only need to retrieve value from third field or compare?

If found first add else two field

CSV lookup table in graylog uses key-value approach. You lookup in key field and return value from value field. So you can’t use use more than 2 fields. But if you want to use more values in value field, you can still concatenate values in this field (separate with unique separator), and use split() pipeline function to extract values.

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.