Global options reference
For the lookup in the enrichment tables to be as performant as possible, the data is indexed according to the fields that are used in the search. Note that indices can only be created for fields for which an exact match is used in the condition. For range searches, an index isn’t used and the enrichment table drops back to a sequential scan of the data. A sequential scan shouldn’t impact performance significantly provided that there are only a few possible rows returned by the exact matches in the condition. We don’t recommend using a condition that uses only date range searches.
true if the first row of the CSV file contains the
headers for each column. This is the default behavior.
If you set it to
false, there are no headers and the columns are referred to
by their numerical index.
Key/value pairs representing mapped log field names and types. This is used to coerce log fields from strings into their proper types. The available types are listed in the Types list below.
Timestamp coercions need to be prefaced with
timestamp|, for example
Timestamp specifiers can use either of the following:
- One of the built-in-formats listed in the Timestamp Formats table below.
- The time format specifiers from Rust’s
timestamp(see the table below for formats)
|ISO 8601[RFC 3339](https://tools.ietf.org/html/rfc3339) format without time zone|
|RFC 822/2822 without time zone|
|ISO 8601/RFC 3339 UTC|
|ISO 8601/RFC 3339 UTC with time zone|
Note: the examples in this table are for 54 seconds after 2:37 am on December 1st, 2020 in Pacific Standard Time.
A list of hosts to avoid proxying. Allowed patterns here include: