Contexts A context is a stateful object that can be used for enrichment in pipelines. You
can manage a context instance with the contextenrich
Lookup Table Bloom Filter Custom Type enrich GeoIP libmaxminddb Context Context Type context create context delete context update use manage key 6.6.6.6 0.9 evil 6.6.6.7 0.1 benign 6.6.6.8 0.7 evil h1(x) h2(x) libmaxminddb context label score from <url> | context update <ctx> key=<field> context create <ctx> lookup-table context delete <ctx> export --live | enrich <ctx> --field <field>
Each context has a specific type that needs to be specified upon construction.
Each context type defines how it processes updates and how it enriches. For
example, the lookup table context extends events
by performing a key-based lookup in a hash table.
The list below shows all available context types. For a more in-depth
introduction into the contextualization framework, please refer to our blog post
Contextualization Made Simple .