Field values can always be overwritten, and in many cases this can be used to your advantage when working with functions that operate on some fields without them needing to be explicitly called out. For example, to overwrite the value of a field just assign the new value:

transferValue := 4857465
| transferValue := (transferValue/8)

But when parsing a timestamp from input data, the timestamp might not be found and so we need to default to another value:

findTimestamp(addErrors=false, timezone=UTC)
| case { @timestamp != *
| @timestamp:=now(); * }

In this example, we try to extract the timestamp from the log line. If the timestamp is not populated by the findTimestamp() then we assign the current timestamp using now().

Basic numerical expressions can be used without requiring special syntax. For example:

bytesTransferred := 4857465
| megabytesTransferred := (bytesTransferred/1024)

For more complex calculations there are a number of functions with the math: prefix. However, each stage of the calculation may need to be performed individually:

sidea := 3
| sideb := 4
| sideasq := math:pow(sidea,exponent=2)
| sidebsq := math:pow(sideb,exponent=2)
| diag := sideasq+sidebsq
| sidec := math:sqrt(diag)

In this example, we've calculated the length of the hypotenuese using Pythagoras's theorem.

There are no implicit operations or typing for strings, so the expressions that might be used for manipulating numerical values do not work the same way for strings. For example, you cannot concatenate strings using an operator:

hw := "Hello" + "World"

All string operations must be performed using functions, and in some cases there may be multiple functions to achieve the same or similar results:

Most other string manipulation operations can be performed using regular expressions.