Skip to content
This is an archived version of the documentation downloaded from LogScale Documentation Archives. Up to date documentation, and documentation for later versions, is available on LogScale Documentation

## `getField()`

Takes an expression — `source` — and sets the field defined by `as` to the result of the `source` expression.

Can be used to manipulate fields whose names are not statically known, but computed at runtime.

Parameter | Type | Required | Default Value | Description
--- | --- | --- | --- | ---
`as` | string | optional[a] | `_getField` | Name of output field.
`source` | expression | required |  | An expression which evaluates the name of the field to read.
[a] Optional parameters use their default value unless explicitly set.

### `getField()` Function Operation

The function can be used to read fields whose exact name might not be known, by getting the value of a dynamically-named field. This happens when the field name is computed from an expression, so the function works by evaluating this expression as input.

It can also be used to manipulate fields whose names contain a space or `-` like in:

logscale

    deltaTime:= now() - getField("time-in-ms")

### `getField()` Examples

Click + next to an example below to get the full details.

#### Get the Last Element of an Array

Retrieve array element values using the `getField()` function

##### Query

logscale

    | index := array:length("foo[]")-1
    | fieldName := format("foo[%s]", field=[index])
    | result := getField(fieldName)

##### Introduction

Given an event with an array for field foo[x]:

    foo['a','b','c','d']

Looks up the value of the field which is part of an array of elements, using `getField()` in combination with expressions: first build the string with the field, then perform `getField()` in that string to get the result.

##### Step-by-Step

1. Starting with the source repository events.

2. logscale

       | index := array:length("foo[]")-1

   Sets the index as the last element of the array (in this case, `[6]`)

3. logscale

       | fieldName := format("foo[%s]", field=[index])

   Takes the field index and builds the string foo[6] using `format()`

4. logscale

       | result := getField(fieldName)

   Provides the value of the field whose name is foo[6]

5. Event Result set.

##### Summary and Results

The output is displayed as follows, where the last column shows the value of fieldName column (which is foo[3]) as the result:

@timestamp | @rawstring | @timestamp.nanos | fieldName | foo[0] | foo[1] | foo[2] | foo[3] | index | result
--- | --- | --- | --- | --- | --- | --- | --- | --- | ---
2024-03-01T08:43:12 | {"foo": ["a","b","c","d"]} | 0 | foo[3] | a | b | c | d | 3 | d

#### Get the Value of a Field Stored in Another Field

Retrieve values from stored fields using the `getField()` function

##### Query

logscale

    result := getField("foo")

##### Introduction

Given an event with the following fields:

    |------------------|
    | foo      | bar   |
    | bar      | 123   |
    | foo      | quux  |
    |------------------|

Do a "direct" lookup where the result is set to the value that is stored in that field, by quoting the string — it takes expressions as input (similar to `eval()` and `test()` functions):

##### Step-by-Step

1. Starting with the source repository events.

2. logscale

       result := getField("foo")

   The result is set to the value that is stored in field foo

3. Event Result set.

##### Summary and Results

bar | foo | result
--- | --- | ---
123 | bar | bar
<no value> | quux | quux

In the same event, using the same query that does not quote the string:

logscale

    result := getField(foo)

will get the value of the field which name is stored at foo, so `123` is stored as the result:

bar | foo | result
--- | --- | ---
123 | bar | 123
<no value> | quux | <no value>

(no result is output for `foo=quux` as `quux` does not exist).

#### Take Field Names as Parameters

Retrieve values using parameters

##### Query

logscale

    | test(getField(?foo)==?bar)

##### Introduction

Use the function to take a field name as a parameter.

Given an event with the following fields:

    |----------------------|
    | hello      | world   |
    |----------------------|

Test if a field exists on an event with a specific value where both the field and the value are given as parameters. This query:

##### Step-by-Step

1. Starting with the source repository events.

2. logscale

       | test(getField(?foo)==?bar)

   Tests if the field given by the parameter `?foo (hello)` is equal to the value given by the parameter `?bar (world)`.

3. Event Result set.

##### Summary and Results

hello
world

#### Enter search term