Skip to main content
When filtering log data, you want to quickly retrieve results, especially when debugging an issue or responding to an incident. To help provide more meaningful results, create lookup tables in a spreadsheet (in CSV format) and upload them to Chronosphere Observability Platform. Lookup tables store pre-calculated results or mappings between values, allowing for faster data retrieval. Use lookup tables to add context, normalize values, and enrich log data for improved filtering. For example, you can enrich severity fields with explanations, map keys like error codes to human-readable descriptions, and standardize inconsistent data. Lookup tables help you apply consistent mappings and enrichments within queries, without hard-coding large or repetitive mapping logic inline. Use lookup tables to: Enrich fields with additional context (for example, mapping severity codes to explanations) Translate opaque identifiers (such as error codes or ids) into human-readable values After uploading lookup tables, users can reference them in log queries using the lookup function.

​
View lookup tables

To view lookup tables:
  1. In the navigation menu, click Go to Admin and then select Control > Logs Lookup Tables. All lookup tables are displayed.
  2. To view a lookup table, click it in the list.

​
Upload lookup tables

To upload a lookup table in Observability Platform, first create a spreadsheet in CSV format. Each lookup table must be less than or equal to 10 MB. You can add up to 1,000 lookup tables. To upload lookup tables that exceed 10 MB, contact Chronosphere Support. To upload lookup tables:
  1. In the navigation menu, click Go to Admin and then select Control > Logs Lookup Tables.
  2. Click Upload lookup table.
  3. In the Upload lookup table page, enter a name and description for your lookup table. Lookup table names must be unique.
  4. Click Upload CSV, and then select the CSV file you want to upload from your local machine.
  5. Click Save to upload your lookup table.
Your lookup table displays in the list of lookup tables, and can be referenced in log queries using the lookup function.

​
Edit lookup tables

You can replace existing lookup tables by uploading a new lookup table. Replacing a lookup table overwrites the existing table.
  1. In the navigation menu, click Go to Admin and then select Control > Logs Lookup Tables.
  2. Click the lookup table you want to replace.
  3. In the Edit lookup table page, click Replace lookup table.
  4. On your local machine, select the CSV file you want to upload.
  5. Click Save to upload your lookup table.
The lookup table is replaced with the one you selected.

​
Delete lookup tables

To delete lookup tables:
  1. In the navigation menu, click Go to Admin and then select Control > Logs Lookup Tables.
  2. Click the lookup table you want to delete.
  3. In the Edit lookup table page, click Delete lookup table.
  4. In the confirmation window, click Delete to delete the lookup table.
The lookup table is deleted from the list of lookup tables.