Field operation functions

Introduction

Field processing functions, processing fields in logs, including getting values, adding, deleting, modifying, querying, etc.

v function

Function definition

Get the field value and return the corresponding string.

Syntax description

v(field)

Parameter description

Example

• Example 1
  

Original log:

{"message": "failed", "status": "500"}

Processing rules:

e_set("new_message", v("message"))

Processing results:

{"message": "failed", "new_message": "failed","status": "500"}

e_set function

Function definition

Used to set field values or add new fields.

Syntax description

e_set(key1, value1, key2, value2, ... , mode="overwrite")

Parameter description

Example

• Example 1
  

Original log:

{"level": "Info"}

Processing rules:

e_set("new_level": "Warning")

Processing results:

{"level": "Info", "new_level": "Warning"}

• Example 2
  

Original log:

{"level": "Info"}

Processing rules:

e_set("level": "Warning")

Processing results:

{"level": "Warning"}

• Example 3
  

Original log:

{"level": "Info"}

Processing rules:

e_set("new1": "Warning", "new2": "Debug")

Processing results:

{"level": "Info", "new1": "Warning", "new2": "Debug"}

e_drop_fields function

Function definition

Match by field name and delete the matched fields.

Syntax description

e_drop_fields(key1, key2, ... )

Parameter description

Example

• Example 1
  

Original log:

{"level": "Info", "status": "500"}

Processing rules:

e_drop_fields("status")

Processing results:

{"level": "Info"}

• Example 2
  

Original log:

{"level": "Info", "status": "500", "code": 200}

Processing rules:

e_drop_fields("status", "level")

Processing results:

{"code":  200}

e_rename function

Function definition

Rename fields.

Syntax description

e_rename("key1", "new key1", "key2", "new key2", ...)

Parameter description

Example

• Example 1
  

Original log:

{"level": "Info", "status": "500"}

Processing rules:

e_rename("level", "new_level")

Processing results:

{"new_level": "Info", "status": "500"}

• Example 2
  

Original log:

{"level": "Info", "status": "500"}

Processing rules:

e_rename("level", "new_level", "status", "new_status")

Processing results:

{"new_level": "Info", "new_status": "500"}