lookupContains operator

The lookupContains operator checks whether a key exists in a lookup table and returns a boolean value.

You can use it as a condition inside a where or if expression in FuseQL.

Syntax

... | where lookupContains(<lookupTableName>, <event-field>=<lookup-field>) | ...

• <lookupTableName> — Name of the lookup table in Kloudfuse.
• <event-field> — A log field to check against. This can be a facet, a label, or a field extracted using the parse operator.
• <lookup-field> — A field in the lookup table used for matching.

Example

Check if the user_id field in logs exists in the lookup table vip_users:

logs
| where lookupContains(vip_users, user_id=id)

This query filters logs to only include events where user_id matches the id field in the vip_users lookup table.