update

Updates a context with new data.

context::update name:string, key=any,
               [value=any, create_timeout=duration,
                write_timeout=duration, read_timeout=duration]

Description

The context::update operator adds new data to a specified context.

Use the key argument to specify the field in the input that should be associated with the context. The context::enrich operator uses this key to access the context. For contexts that support assigning a value with a given key, you can provide an expression to customize what’s being associated with the given key.

The three arguments create_timeout, write_timeout, and read_timeout only work with lookup tables and set the respective timeouts per table entry.

name: string

The name of the context to update.

key = any

The field that represents the enrichment key in the data.

value = any (optional)

The field that represents the enrichment value to associate with key.

Defaults to this.

create_timeout = duration (optional)

Expires a context entry after a given duration since entry creation.

write_timeout = duration (optional)

Expires a context entry after a given duration since the last update time. Every Every call to context::update resets the timeout for the respective key.

read_timeout = duration (optional)

Expires a context entry after a given duration since the last access time. Every call to context::enrich resets the timeout for the respective key.

Examples

Populate a lookup table with data

Create a lookup table:

context::create_lookup_table "ctx"

Add data to the lookup table via context::update:

from {x:1, y:"a"},
     {x:2, y:"b"}
context::update "ctx", key=x, value=y

Retrieve the lookup table contents:

context::inspect "ctx"

{key: 2, value: "b"}
{key: 1, value: "a"}

Use a custom value as lookup table

from {x:1},
     {x:2}
context::update "ctx", key=x, value=x*x

{key: 2, value: 4}
{key: 1, value: 1}

See Also

context::create_bloom_filter, context::create_geoip, context::create_lookup_table, context::enrich, context::erase, context::inspect, context::list, context::load, context::remove, context::reset, context::save