Skip to main content
An extend table is a small key → record lookup table you maintain in MoleSignal and join against from a pipeline transform. Use one to enrich events with reference data — map a service to its owning team, an account ID to a plan tier, an IP range to a region — without calling out to an external store on the hot path.

​
Create a table and add rows

Create tables under Functions → Extend tables. Each row is a key plus a record of named fields. You can also manage them over the API: 
# upsert a row keyed by "checkout"
curl -X PUT http://localhost:5080/api/v1/extend_tables/service_meta/rows/checkout \
  -H "authorization: Bearer $MS_JWT" \
  -H 'content-type: application/json' \
  -d '{"team":"payments","tier":"gold"}'
ActionEndpoint
List tablesGET /api/v1/extend_tables
List a table’s rowsGET /api/v1/extend_tables/{table}
Upsert a rowPUT /api/v1/extend_tables/{table}/rows/{key}
Delete a rowDELETE /api/v1/extend_tables/{table}/rows/{key}

​
Look it up from a transform

Inside a VRL transform, call lookup(table, key) and read a field off the returned record: 
# enrich each event with the service's owning team
.team = lookup("service_meta", .service).team
Lookups run in memory, so they add no query or storage cost to a pipeline run. The table is loaded on startup and kept current as you upsert and delete rows.
Extend tables are scoped to your organization and shared across all pipelines — define a mapping once and reuse it everywhere.

Pipelines

Build the transform chain that calls your extend tables.