Lookup Entity Values Using Parsed Log Data in DQL

zip-chanko — Thu, 18 Dec 2025 14:05:24 GMT

I have the content with json in logs which has a key `client_ip` and trying to get the pod name which has `internalIpAddresses` from `dt.entity.cloud_application_instance`. So trying to lookup the IP I got from the logs `client_ip` with `internalIpAddresses` and get the pod name (entity.name). But `lookup` always returns `null` values. Please help advise. TIA.

I tried these queries.

fetch dt.entity.cloud_application_instance | fieldsAdd internalIpAddresses

busybox_1	CLOUD_APPLICATION_INSTANCE-30A007499C4655B1	192.168.2.3
busybox_2	CLOUD_APPLICATION_INSTANCE-8CBE6E71FB1BABC6	192.168.2.4

fetch logs | filter matchesValue(aws.log_group, "/aws/logs/alb") | parse content , "JSON:record" | fieldsAdd record[client_ip], alias:client_ip | fieldsAdd record[domain_name], alias:domain_name | fieldsAdd record[elb_status_code], alias:elb_status_code | filter client_ip != "" | fields timestamp, client_ip, domain_name, elb_status_code | lookup sourceField:client_ip, lookupField:internalIpAddresses, [fetch dt.entity.cloud_application_instance], fields:{entity.name}

2024-08-09T20:50:01.581000000+10:00	192.168.2.3	example.com	200	null
2024-08-09T20:50:02.309000000+10:00	192.168.2.3	example.com	200	null
2024-08-09T20:50:02.368000000+10:00	192.168.2.4	example.com	200	null

Sample content

{ "client_ip": "192.168.2.3", "target_port": 443, "elb_status_code": "200", "target_status_code": "200", "request_verb": "POST", "domain_name": "example.com" }

Re: Lookup value from entity with the parsed value from logs

ChadTurner — Mon, 29 Sep 2025 19:42:30 GMT

I don't see you calling out the fields add for entity name.

topic Lookup Entity Values Using Parsed Log Data in DQL in DQL

Lookup Entity Values Using Parsed Log Data in DQL

Re: Lookup value from entity with the parsed value from logs