Mapping enrichment functions
Last Updated：2025-11-14
Mapping enrichment functions
Introduction
Add new fields according to rules based on existing fields.
e_dict_map function
Function definition
Map with the target table, return the field value according to the input field name, which can be simply understood as the association between logs and dimension tables.
Syntax description
e_dict_map(data, field, output_field, case_insensitive=true, missing='', mode="overwrite")Parameter description
| Parameter name | Parameter description | Parameter type | Required or not | Parameter default | Parameter range |
|---|---|---|---|---|---|
| data | Target table (dimension table) | Table | Yes | - | - |
| field | The source field in the log that maps to the table. If the corresponding field does not exist in the log, no operation is performed. Support String and String List | Any | Yes | - | - |
| output_field | Mapped fields. For example, ["province", "pop"]. Support String and String List | Any | Yes | - | - |
| case_insensitive | Whether the matching is case-insensitive. | Bool | No | true | true/false |
| missing | When there is no matching field, assign the value of this parameter to the output field output_field. The default is empty, indicating no mapping assignment operation is performed. | String | No | '' | - |
| mode | Field overwriting mode. The default is overwrite | String | No | overwrite | fill/fill-auto/add/add-auto/overwrite/overwrite-auto |
Example
- Example 1
Original log:
{"status": "500"}Processing rules:
e_dict_map({"k1": ["k11", "k12"], "k2": "k22"}, "k1", "new")Processing results:
{"new": ["k11", "k12"], "status": "500"}