feat: KeyValues initial implementation

.single_tenant_bq.env

@@ -15,5 +15,5 @@ LOGFLARE_GRPC_PORT=50051
 
 LOGFLARE_NODE_HOST=127.0.0.1
 LOGFLARE_HTTP_CONNECTION_POOLS=all
-LOGFLARE_FEATURE_FLAG_OVERRIDE=multibackend=true
+LOGFLARE_FEATURE_FLAG_OVERRIDE=multibackend=true,key_values=true
 

.single_tenant_pg.env

@@ -14,5 +14,4 @@ LOGFLARE_GRPC_PORT=50051
 POSTGRES_BACKEND_URL=postgresql://postgres:postgres@localhost:5432/logflare_dev
 LOGFLARE_NODE_HOST=127.0.0.1
 LOGFLARE_HTTP_CONNECTION_POOLS=all
-LOGFLARE_FEATURE_FLAG_OVERRIDE=multibackend=true
-
+LOGFLARE_FEATURE_FLAG_OVERRIDE=multibackend=true,key_values=true

docs/docs.logflare.com/docs/concepts/ingestion/index.mdx

@@ -109,6 +109,8 @@ At ingestion, the pipeline will perform the following in sequence:
 
 3. If set, fields will be copied in sequence. See [field copying](#copy-fields) for more details.
 
+4. If set, key-value enrichment will be applied. See [key-value enrichment](#key-value-enrichment) for more details.
+
 ### Key Transformation
 
 When logging object, your object keys will be transformed automatically to comply with the respective backend in use. For example, BigQuery column requirements require that names only contain letters (a-z, A-Z), numbers (0-9), or underscores (\_), and it must start with a letter or underscore. This will be automatically handled for you when ingesting data.
@@ -153,6 +155,49 @@ _top_level:my_copied_field
 Destination field names must match the BigQuery colummn name specification, or the event risks being rejected.
 :::
 
+### Key-Value Enrichment
+
+:::info Pro Plan / Self-Hosted
+Key-value enrichment is available on Pro plans and for self-hosted deployments.
+:::
+
+A source can be configured to enrich events using key-value lookups at ingestion time. Key-value pairs are stored per account and shared across all sources. When a rule is configured, the source field's value is used to look up a key in the key-value store, and the result is set on the destination field.
+
+The configuration pattern is `source_field:destination_field`, one rule per line. Dot syntax is supported for nested paths, and `m.` can be used as shorthand for `metadata.`.
+
+For example, with the configuration:
+
+```text
+project:org_id
+```
+
+And a key-value entry in your account's key-value store:
+
+```
+key:   123abc
+value: 456def
+```
+
+An incoming event:
+
+```json
+{ "project": "123abc" }
+```
+
+Will be enriched to:
+
+```json
+{ "project": "123abc", "org_id": "456def" }
+```
+
+If no matching key is found, the event is left unchanged. Only string field values are looked up; non-string values (numbers, booleans, etc.) are skipped.
+
+Key-value pairs can be managed via the [Management API](https://logflare.app/swaggerui).
+
+:::note
+Key-value enrichment runs after field copying, so copied fields can be used as lookup sources.
+:::
+
 ## Adaptive Schema
 
 As your logging needs changes, Logflare is capable of detecting and adjusting the database schema accordingly. This allows you to focus on analyzing your logs instead of having to manage your logging pipeline manually.