Hi, To keep it simple, would a simple monitor stanza in your inputs.conf pointing at the lookup file work?
Presuming its just a CSV or similar.
Then if it changes, the changes should be ingested. In that case, any event produced could be used to trigger an alert, and the ingested data would be the change / delta.
... View more