Event & Data Manipulation Query Functions
LogScale's event and data manipulation functions allow event creation, modification and data manipulation of events and fields within the event.
Table: Event & Data Manipulation Query Functions
| Function | Default Argument | Availability | Description |
|---|---|---|---|
array:contains(array, value) | array | Checks whether the given value matches any of the values of the array and excludes the event if no value matches. | |
array:filter(array, [asArray], function, var) | array | Drops entries from the input array using the given filtering function. | |
array:reduceAll(array, function, var) | array | Computes a value from all events and array elements of the specified array. | |
array:reduceColumn(array, [as], function, var) | array | Computes an aggregate value for each array element with the same index. | |
array:union(array, [as]) | array | Determines the set union of array values over input events. | |
bitfield:extractFlags(field, [onlyTrue], output) | Interprets an integer as a bit field and extracts the specified flags. | ||
coalesce([as], expressions, [ignoreEmpty]) | expressions | Selects the value of the first expression from a list of expressions | |
concat([as], field) | field | Concatenates the values of a list of fields into a value in a new field. | |
concatArray([as], field, [from], [prefix], [separator], [suffix], [to]) | field | Concatenates values of all fields with same name and an array suffix into a new field. | |
copyEvent(type) | type | Duplicates event so pipeline will see both events. | |
drop(fields) | fields | Removes attributes or columns from a result set. | |
dropEvent() | Drops completely an event in parser pipeline to stop it from being ingested. | ||
eval() | Creates a new field by evaluating the provided expression. | ||
format([as], field, format, [timezone]) | format | Formats a string using printf-style. | |
getField([as], source) | introduced in 1.127.0 | Reads dynamically-named fields that are computed from an expression. | |
json:prettyPrint([as], [field], [step], [strict]) | field | Nicer output to a JSON field. | |
lowercase(field, [include], [locale]) | field | Changes field name or content to lowercase for parsers. | |
parseCEF([field], [headerprefix], [keeplabels], [labelprefix], [prefix]) | field | Parses CEF version 0.x encoded messages. | |
parseCsv(columns, [delimiter], [excludeEmpty], field, [trim]) | field | Parses a CSV-encoded field into known columns. | |
parseHexString([as], [charset], field) | field | Parses input from hex encoded bytes, decoding resulting bytes as a string. | |
parseJson([exclude], [excludeEmpty], field, [handleNull], [include], [prefix], [removePrefixes]) | field | Parses specified fields as JSON. | |
parseLEEF([delimiter], [field], [headerprefix], [keeplabels], [labelprefix], [parsetime], [prefix], [timezone]) | field | Parses LEEF version 1.0 and 2.0 encoded messages. | |
readFile(file, [include], [limit]) | file | introduced in 1.130.0 | Uses a .csv lookup file as data input for the query. |
rename([as], field) | field | Renames one or more given fields. | |
replace([as], [field], [flags], regex, [replacement], [with]) | regex | Replaces each substring that matches given regular expression with given replacement. | |
sankey(source, target, [weight]) | Produces data compatible with Sankey widget. | ||
series(collect, [endmatch], [maxduration], [maxpause], [memlimit], [separator], [startmatch]) | collect | Collects a series of values for selected fields from multiple events into one or more events. | |
setField(target, value) | introduced in 1.127.0 | Sets fields whose names are not known but computed from an expression. | |
split([field], [strip]) | field | Splits an event structure created by a JSON array into distinct events. | |
splitString([as], by, [field], [index]) | field | Splits a string by specifying a regular expression by which to split. | |
stripAnsiCodes([as], field) | field | Removes ANSI color codes and movement commands. | |
transpose([column], [header], [limit], [pivot]) | pivot | Transposes a query results set by creating an event for each attribute. | |
unit:convert([as], [binary], field, [from], [keepUnit], [to], [unit]) | field | Converts values between different units. | |
upper([as], field, [locale]) | field | Changes contents of a string field to upper-case letters. | |
urlEncode([as], field, [type]) | field | URL-encodes the contents of a string field. | |
writeJson([as], [field]) | field | Writes data, including fields, as a JSON object. | |
xml:prettyPrint([as], field, [step], [strict], [width]) | field | Nicer output to an XML field. |