Tagging data based on lookup table

Hey everyone,
I’m trying to tag my data according to a lookup table.
The lookup table has these fields:

Key- represent the field name in the data I want to tag.
In the real data the field is a subfield of “Headers” field..
An example for the “Key” field:
“Server. (* is a wildcard)

Value- represent the wanted value of the mantioned field above.
The value in the lookup table is only a part of a string in the real data value.
An example for the “Value” field:

Vendor- the value I want to add to the real data if a combination of field- value is found in an document.

An example for combination in the real data:
“Headers.Server : Linux/2.x UPnP/1.0 Avtech/1.0”

A match with that document in the look up table will be:
Key= Server (with wildcard on both sides)
Value= Avtech (with wildcard on both sides)
Vendor= Avtech

So baisically I’ll need to add a field to that document with the value- “ Avtech”.

  • the subfields in “Headers” are dynamic fields that changes from document to document.
  • of a match is not found I’ll need to add to the tag field with value- “Unknown”.

I’ve tried to use the enrich processor , use the lookup table as the source data , the match field will be ”Value” and the enrich field will be “Vendor”.
In the enrich processor I didn’t know how to call to the field since it’s dynamic and I wanted to search if the value is anywhere in the “Headers” subfields.
Also, I don’t think that there will be a match between the “Value” in the lookup table and the value of the Headers subfield, since “Value” field in the lookup table is a substring with wildcards on both sides.

I can use some help to accomplish what I’m trying to do.. and how to search with wildcards inside an enrich processor.


This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.