Expression

A CQL expression represents any valid query syntax that can be evaluated to produce a result. Expressions can range from simple field references and literal values to complex calculations, function calls, conditional logic, and nested operations.

Expressions are used throughout LogScale for defining conditions, calculating derived values, transforming data, and controlling query flow. They can include arithmetic operations, string manipulations, logical comparisons, and calls to both aggregate and non-aggregate functions.

For example, status < 500 is a simple comparison expression, while success := if(status < 500, then=if(status!=404, then=1, else=0), else=0) is a complex nested expression that creates a new field based on conditional logic.

Simple comparison expression
logscale
status < 500
Field calculation
logscale
total := bytes_sent + bytes_received
Conditional expression
logscale
level := if(severity>=8, then="critical", else="normal")
Nested expression
logscale
success := if(status < 500, then=if(status!=404, then=1, else=0), else=0)
String manipulation
logscale
fullname := format("%s %s", field=[firstname, lastname])

Functions using this Type: dropEvent(), eval(), fieldset(), getField(), if(), join(), selfJoin(), selfJoinFilter(), setField(), test(), text:editDistance(), text:editDistanceAsArray(), text:trim(), text:contains(), text:endsWith(), text:length(), text:positionOf(), text:startsWith(), text:substring()