I’m looking to implement an inline hostname-to-IP mapping inside Fluent Bit. For example: Device = {"mylaptop": "192.168.0.100"} The goal is to enrich incoming logs by injecting a device_ip field based on this lookup. What’s the most efficient and scalable approach to achieve this—is there a more optimal native method within Fluent Bit’s pipeline?

I imagine the best way would be to inject this at source 🙂 rather than look it up later which may always be out of date to some degree. Otherwise maybe just a LUA processor to do it, depends how you're "looking it up" really - from a local file, from a web service, from DNS, from something else? LUA can cover all those though.

I agree—injecting it at the source would definitely be the ideal approach. Unfortunately, due to network and device restrictions, that isn’t an option for me. I’m trying to keep this configuration-only, avoiding Lua if possible. If there’s any other efficient alternative supported by Fluent Bit, I’d really appreciate suggestions.