In this example, the match() function is used to match multiple pairs of fields against multiple columns in a CSV file named test.csv simultaneously.

Example incoming event data might look like this:

[
   {
      "field1" : "c",
      "field2" : "f"
   },
   {
      "field2" : "e",
      "field1" : "c"
   }
]

Example test.csv file data might look like this:

The query is used to match multiple pairs of event fields against multiple columns in the .CSV file named test.csv. Multiple field matching helps validate and enrich complex event data.

Sample output from the incoming example data:

In this example, the match() function is used with a negation to search and find IP addresses, that are not part of a known list known_ips.csv.

Example incoming data might look like this:

The query is used to search for unknown or unexpected source IP addresses matched up againt a known list. This is useful for detecting potential security theats and monitoring for unauthorized network access.

Sample output from the incoming example data:

In this example, the match() function is used to match the column userid of the users.csv file against the id field in the event.

The query is used to compare and match event fields and file values as strings, in this case using exact string matching (the default value of the mode parameter is string). The match() function is useful for comparing or combining data from multiple sources. In this example, only events with matching values are passed on, meaning that all events with non-matching IDs are removed. Matching events against an authorized users list is, for example, useful for filtering out unauthorized access attempts, for validation of user activities, or other monitoring.

In this example, the match() function is used to match event IP addresses against the column cidr-block of the cidr-file.csv file, adding specific columns details to the events.

The query matches IP addresses against CIDR blocks (CIDR subnets) and adds specific network information from the columns info and type to the output rows.

Example incoming event data might look like this:

Example cidr-file.csv file data might look like this:

The query is used to match IP addresses against CIDR blocks and add specific network information from the columns info and type to the output rows.

The query helps analyze network traffic and security events by mapping IP addresses to network segments.

Sample output from the incoming example data:

Note how only the specified fields from the cidr-file.csv file appear in output.

In this example, the match() function is used to match event IDs against the column userid of the users.csv file, adding the matching user details to the events. As the strict parameter is set to true, all events - including non-matching events - are passed through, but only events with matches will be enriched with all other columns of the matching row.

Example incoming event data might look like this:

Example users.csv file data might look like this:

The query is used to enrich matching events while allowing all events to pass through. Matching events against an authorized users list is, for example, useful for filtering out unauthorized access attempts, for validation of user activities, or other monitoring. Showing non-matching events in output as well can, for example, be useful for tracking unauthorized access attempts, identifying unknown users or systems or for monitoring suspicious activities.

Sample output from the incoming example data:

After matching, the output combines original event fields with matched user details. Note how also non-matching events (in this example unknown-user) appear in output.

In this example, the match() function is used with glob pattern matching (defined by the mode parameter) to match event IDs against the column userid of the users.csv file, adding the matching user details to the events.

Example incoming event data might look like this:

Example users.csv file data might look like this:

The query is used to match event IDs against patterns in a user list, and then add the matching user details (other columns from the row in the users.csv file) to the events.

Pattern-based matching with field enrichment is, for example, useful in case you want to add user context to authentication logs.

Sample output from the incoming example data:

After matching, the output combines original event fields with matched user details. Only events with matching patterns appear in output.