Evaluates an arbitrary expression as a boolean value and filters events
when the expression returns true. Not only can Falcon LogScale make
comparisons between one field and one value, but it can also compare more
fields and their respective values, using the test()
function.
Note
In test()
unquoted strings are interpreted as field
names.
Parameter | Type | Required | Default | Description |
---|---|---|---|---|
expression [a] | expression | required | The expression to test. | |
[a] The argument name |
Hide omitted argument names for this function
Omitted Argument NamesThe argument name for
expression
can be omitted; the following forms of this function are equivalent:logscaletest("value")
and:
logscaletest(expression="value")
These examples show basic structure only.
Hide negatable operation for this function
Negatable Function OperationThis function is negatable, implying the inverse of the result. For example:
logscale!test()
Or:
logscalenot test()
For more information, see Negating the Result of Filter Functions.
test()
Examples
The following tests if the value of the field foo is less than the value of the field bar:
test(foo < bar)
This example compares a field value within the LogScale repository:
test(cputime < 7500)
Check if field contains specific value
test(myField == "myOtherField")
The test()
function can be used to make
comparisons between one field and one value, and it can also
compare more fields and their respective values. In this example,
the test()
function is used to check if a
field contains a specific value.
Starting with the source repository events
- flowchart LR; %%{init: {"flowchart": {"defaultRenderer": "elk"}} }%% repo{{Events}} 0[(Filter Function)] result{{Result Set}} repo --> 0 0 --> result style 0 fill:#ffbf00; style 0 fill:#ff0000,stroke-width:4px,stroke:#000;
Returns all events where field myField holds the specific value myOtherField. Notice the use of double-quotations. If the string had been
test(myField == myOtherField)
, then it would have returned results where the fields contained the same values and not a specific value.logscaletest(myField == "myOtherField")
Event Result set
The query is used to check if a field contains a specific value.
It is the same as myField = myOtherField
except that this syntax does not support field names with spaces
as the test()
function does.
Check if fields contain same value
test(length(userid) == length(method))
The test()
function can be used to make
comparisons between one field and one value, and it can also
compare more fields and their respective values. In this example,
the test()
function is used to search for
events where the userid field and
method field have the same length.
Starting with the source repository events
- flowchart LR; %%{init: {"flowchart": {"defaultRenderer": "elk"}} }%% repo{{Events}} 0[(Filter Function)] result{{Result Set}} repo --> 0 0 --> result style 0 fill:#ffbf00; style 0 fill:#ff0000,stroke-width:4px,stroke:#000;
Returns all events where field userid has the same length as the method field. This could for example be events with
Chad
andPOST
, andPeter
andPATCH
.logscaletest(length(userid) == length(method))
Event Result set
The query is used to compare more fields and their respective values.
Compare more fields and filter for specific events
test(field1 != 2 * field2)
The test()
function can be used to make
comparisons between one field and one value, and it can also
compare more fields and their respective values. Furthermore, it
is possible to use a negation to filter for specific events. In
this example, the test()
function is used to
filter for events where the value of field1
is not exactly twice as large as the value in
field2.
Starting with the source repository events
- flowchart LR; %%{init: {"flowchart": {"defaultRenderer": "elk"}} }%% repo{{Events}} 0[(Filter Function)] result{{Result Set}} repo --> 0 0 --> result style 0 fill:#ffbf00; style 0 fill:#ff0000,stroke-width:4px,stroke:#000;
Filters for events where the value of the field field1 is not exactly twice as large as the value in field field2.
logscaletest(field1 != 2 * field2)
Event Result set
The query is used to compare more fields and filter for specific events that are not of a certain size.
Compare more fields and their respective values
test(field1 < field2)
The test()
function can be used to make
comparisons between one field and one value, and it can also
compare more fields and their respective values. In this example,
the test()
function is used to check if the
value of field1 is less than the value in
field2.
Starting with the source repository events
- flowchart LR; %%{init: {"flowchart": {"defaultRenderer": "elk"}} }%% repo{{Events}} 0[(Filter Function)] result{{Result Set}} repo --> 0 0 --> result style 0 fill:#ffbf00; style 0 fill:#ff0000,stroke-width:4px,stroke:#000;
Evaluates if the value of the field field1 is less than the value in field field2.
logscaletest(field1 < field2)
Event Result set
The query is used to compare more fields and their respective values.
Evaluate Arbitrary Expression as Boolean Value
test(foo < bar)
The test()
function is used to evaluate
arbitrary expressions as boolean values in a query. Arbitrary
expressions are used for various purposes, like performing
calculations, making decisions, and defining conditions. In this
example, the test()
function evaluates the
arbitrary expression <
as a boolean value
(true/false) and filters events when the expression returns true.
Starting with the source repository events
- flowchart LR; %%{init: {"flowchart": {"defaultRenderer": "elk"}} }%% repo{{Events}} 0[(Filter Function)] result{{Result Set}} repo --> 0 0 --> result style 0 fill:#ffbf00; style 0 fill:#ff0000,stroke-width:4px,stroke:#000;
Evaluates if the value of the field foo is less than the value of the field bar.
logscaletest(foo < bar)
Event Result set
The query is used to evaluate arbitrary expressions as boolean
values in a query. This is used to filter events where the
expression returns true. The difference between using the
test()
function instead of the
match()
function is that
test()
returns a boolean value and
match()
returns a string.
Evaluate Arbitrary Field Values for CPU Time within Repository
test(cputime < 7500)
The test()
function is used to evaluate
arbitrary expressions as boolean values in a query. Arbitrary
expressions are used for various purposes, like performing
calculations, making decisions, and defining conditions. In this
example, the test()
function evaluates the
arbitrary expression <
as a boolean value
(true/false) and filters events when the expression returns true.
Starting with the source repository events
- flowchart LR; %%{init: {"flowchart": {"defaultRenderer": "elk"}} }%% repo{{Events}} 0[(Filter Function)] result{{Result Set}} repo --> 0 0 --> result style 0 fill:#ffbf00; style 0 fill:#ff0000,stroke-width:4px,stroke:#000;
Evaluates if the value of the field cputime is less than the value
7500
in a repository.logscaletest(cputime < 7500)
Event Result set
The query is used to evaluate arbitrary expressions as boolean
values in a query. This is used to filter events where the
expression returns true. The difference between using the
test()
function instead of the
match()
function is that
test()
returns a boolean value and
match()
returns a string. Searching for CPU
times is useful when troubleshooting performance issues in a
system.
Evaluate field values within repository
test(cputime < 7500)
The test()
function is used to evaluate
arbitrary expressions as boolean values in a query. Arbitrary
expressions are used for various purposes, like performing
calculations, making decisions, and defining conditions. In this
example, the test()
function evaluates the
arbitrary expression <
as a boolean value
(true/false) and filters events when the expression returns true.
Starting with the source repository events
- flowchart LR; %%{init: {"flowchart": {"defaultRenderer": "elk"}} }%% repo{{Events}} 0[(Filter Function)] result{{Result Set}} repo --> 0 0 --> result style 0 fill:#ffbf00; style 0 fill:#ff0000,stroke-width:4px,stroke:#000;
Evaluates if the value of the field cputime is less than
7500
.logscaletest(cputime < 7500)
Event Result set
The query is used to compare a field value within the Falcon LogScale repository.