Event operation functions
Last Updated：2025-11-14
Event operation functions
Introduction
Functions for processing a single line of logs, including filtering, distribution, splitting, etc.
e_drop function
Function definition
Discard logs that meet the conditions.
Syntax description
e_drop(condition)Parameter description
| Parameter name | Parameter description | Parameter type | Required or not | Parameter default | Parameter range |
|---|---|---|---|---|---|
| Condition | A function expression with a value of bool type | Bool | Yes | - | - |
Example
- Example 1
Original log:
[
{
"field": "a,b,c",
"status": "500"
},
{
"field": "a,b,c",
"status": "200"
}
]Processing rules:
e_drop(v("status")=="500")Processing results:
[
{
"field": "a,b,c",
"status": "200"
}
]e_keep function
Function definition
Retain logs that meet the conditions.
Syntax description
e_keep(condition)Parameter description
| Parameter name | Parameter description | Parameter type | Required or not | Parameter default | Parameter range |
|---|---|---|---|---|---|
| Condition | A function expression with a value of bool type | Bool | Yes | - | - |
Example
- Example 1
Original log:
[
{
"field": "a,b,c",
"status": "500"
},
{
"field": "a,b,c",
"status": "200"
}
]Processing rules:
e_keep(v("status")=="500")Processing results:
[
{
"field": "a,b,c",
"status": "500"
}
]