How to implement customized fetch data when remap, similar to geoip

[tangguangliang]

To parse a geoip use the following

.geoip = get_enrichment_table_record!("geoip", { "ip": .xff })

I have an id data like 10001, 10002, I want to parse the json data and get the result in json when I pass in the ids {"10001": {"region": "eu", "name": "hello world"}} by using a form similar to geoip. What should I do?

[jszwedko]

Hi @tangguangliang !

I'm not really sure what you are trying to do, could you provide more details? A full example of input and output would help. The GeoIP enrichment functions are designed to be used with Maxmind GeoIP databases.

[tangguangliang]

Thanks for your reply, what I mean is that I need to add a new field to the source data collected by the vector.
This field is parsed from the id in the source data, for example, in the nginx logs I'm collecting there is a field {"id": "10001"}.
I need to go to another place by querying {"id": "10001", "region": "est"} with the id 10001.
I want to return region=est by querying id=10001 and then add region=est to the source data sent to elasticsearch

I don't know if I'm describing it well.