Available: getField() v1.127.0

The getField() function is available from v1.127.0

Takes an expression — source — and sets the field defined by as to the result of the source expression.

Can be used to manipulate fields whose names are not statically known, but computed at runtime.

ParameterTypeRequiredDefaultDescription
asstringoptional[a]_getField Name of output field.
sourceexpressionrequired  An expression which evaluates the name of the field to read.

[a] Optional parameters use their default value unless explicitly set

The function can be used to read fields whose exact name might not be known, by getting the value of a dynamically-named field. This happens when the field name is computed from an expression, so the function works by evaluating this expression as input.

It can also be used to manipulate fields whose names contain a space or - like in:

logscale
deltaTime:= now() - getField("time-in-ms")

getField() Examples

Getting the value of a field stored in another field

Query
flowchart LR; %%{init: {"flowchart": {"defaultRenderer": "elk"}} }%% repo{{Events}} 0[/Filter/] result{{Result Set}} repo --> 0 0 --> result
logscale
result := getField("foo")
Introduction

Given an event with the following fields: 

|------------------|
| foo      | bar   |                        
| bar      | 123   |
| foo      | quux  |
|------------------|

Do a "direct" lookup where the result is set to the value that is stored in that field, by quoting the string — it takes expressions as input (similar to eval() and test() functions):

Step-by-Step

  1. Starting with the source repository events

  2. flowchart LR; %%{init: {"flowchart": {"defaultRenderer": "elk"}} }%% repo{{Events}} 0[/Filter/] result{{Result Set}} repo --> 0 0 --> result style 0 fill:#ff0000,stroke-width:4px,stroke:#000;

    The result is set to the value that is stored in field foo

    logscale
    result := getField("foo")

  3. Event Result set

Summary and Results

barfooresult
123barbar
<no value>quuxquux

In the same event, using the same query that does not quote the string:

logscale
result := getField(foo)

will get the value of the field which name is stored at foo, so 123 is stored as the result:

barfooresult
123bar123
<no value>quux<no value>

(no result is output for foo=quux as quux does not exist).

Taking field names as parameters

Query
flowchart LR; %%{init: {"flowchart": {"defaultRenderer": "elk"}} }%% repo{{Events}} 0[/Filter/] result{{Result Set}} repo --> 0 0 --> result
logscale
| test(getField(?foo)==?bar)
Introduction

Use the function to take a field name as a parameter.

Given an event with the following fields: 

|----------------------|
| hello      | world   |                        
|----------------------|

Test if a field exists on an event with a specific value where both the field and the value are given as parameters. This query:

Step-by-Step

  1. Starting with the source repository events

  2. flowchart LR; %%{init: {"flowchart": {"defaultRenderer": "elk"}} }%% repo{{Events}} 0[/Filter/] result{{Result Set}} repo --> 0 0 --> result style 0 fill:#ff0000,stroke-width:4px,stroke:#000;

    tests if the field given by the parameter ?foo (hello) is equal to the value given by the parameter ?bar (world).

    logscale
    | test(getField(?foo)==?bar)

  3. Event Result set

Summary and Results

hello
world

Getting the last element of an array

Query
flowchart LR; %%{init: {"flowchart": {"defaultRenderer": "elk"}} }%% repo{{Events}} 0[\Add Field/] 1[\Add Field/] 2[\Add Field/] result{{Result Set}} repo --> 0 0 --> 1 1 --> 2 2 --> result
logscale
| index := array:length("foo[]")-1
| fieldName := format("foo[%s]", field=[index])
| result := getField(fieldName)
Introduction

Given an event with an array for field foo[x]: 

foo['a','b','c','d']

Look up the value of the field which is part of an array of elements, using getField() in combination with expressions: first build the string with the field, then perform getField() in that string to get the result.

Step-by-Step

  1. Starting with the source repository events

  2. flowchart LR; %%{init: {"flowchart": {"defaultRenderer": "elk"}} }%% repo{{Events}} 0[\Add Field/] 1[\Add Field/] 2[\Add Field/] result{{Result Set}} repo --> 0 0 --> 1 1 --> 2 2 --> result style 0 fill:#ff0000,stroke-width:4px,stroke:#000;

    Set the index as the last element of the array (in this case, [6])

    logscale
    | index := array:length("foo[]")-1
  3. flowchart LR; %%{init: {"flowchart": {"defaultRenderer": "elk"}} }%% repo{{Events}} 0[\Add Field/] 1[\Add Field/] 2[\Add Field/] result{{Result Set}} repo --> 0 0 --> 1 1 --> 2 2 --> result style 1 fill:#ff0000,stroke-width:4px,stroke:#000;

    Take the field index and build the string foo[6] using format()

    logscale
    | fieldName := format("foo[%s]", field=[index])
  4. flowchart LR; %%{init: {"flowchart": {"defaultRenderer": "elk"}} }%% repo{{Events}} 0[\Add Field/] 1[\Add Field/] 2[\Add Field/] result{{Result Set}} repo --> 0 0 --> 1 1 --> 2 2 --> result style 2 fill:#ff0000,stroke-width:4px,stroke:#000;

    Provide the value of the field whose name is foo[6]

    logscale
    | result := getField(fieldName)

  5. Event Result set

Summary and Results

The output is displayed as follows, where the last column shows the value of fieldName column (which is foo[3]) as the result:

@timestamp@rawstring@timestamp.nanosfieldNamefoo[0]foo[1]foo[2]foo[3]indexresult
2024-03-01T08:43:12{"foo": ["a","b","c","d"]}0foo[3]abcd3d