Lookup internals¶
Lookup Service¶
The lookup management service handling:
- Read-only lookup objects that can run both in asynchronous and synchronous mode (there is an on tick refresh)
- Write-only lookup modifier objects
- Builder objects for synchronous lookups files to be used by builder services
The service provides an interface both to BSPump and to SP-Lang.
Lookup Types¶
Synchronous lookups¶
Synchronous lookups are lookups loaded from files, which include:
- IP address lookups
- Elasticsearch lookups serialized to file
The creation of synchronous lookups is handled by the LogMan.io Lookup Builder (see configuration), whose output stored in /lookups folder.
Asynchronous lookups¶
Lookups directly loaded from Elasticsearch.
If the synchronous lookup file is missing or is corrupted, the processing is automatically handled by asynchronous lookups.
Asynchronous lookups require less setting, but are less optimal than synchronous lookups.