Deprecated: 1.30

This function is deprecated. Refer to match() function instead.

Enhances events with metadata. Data can be managed in the Files tab in the UI or be uploaded as CSV or JSON files using the files endpoint.

ParameterTypeRequiredDefaultDescription
fromstringtrue Specifies the source file. [a]
include[string]false Specifies fields to include, defaults to all.
on[string]true Specifies which field(s) to join on; if passed as array the first is the field from the file, the second is from the event.

[a] When you provide only one parameter, the implied parameter is from

Examples

Lookup rows from table users.csv where the userid column equals the id field of this event

humio
lookup("users.csv", on=[userid,id])