Available: setField() v1.127.0

The setField() function is available from v1.127.0

Takes two expressions — target and value — and sets the field named by the result of the target expression to the result of the value expression.

Can be used to manipulate fields whose names are not statically known, but computed at runtime.

ParameterTypeRequiredDefaultDescription
targetexpressionrequired__setField Evaluates the name of the field to set.
valueexpressionrequired  An expression whose result becomes the value for the field.

setField() Examples

Setting the value of a field

Query
flowchart LR; %%{init: {"flowchart": {"defaultRenderer": "elk"}} }%% repo{{Events}} 0[\Add Field/] 1[(Function)] result{{Result Set}} repo --> 0 0 --> 1 1 --> result
logscale
item := 4
| setField(target="foo", value=item + 10)
Introduction

Set the value of a target field as the result of an expression. This is equivalent to:

logscale
item := 4
| foo := item + 10

Step-by-Step

  1. Starting with the source repository events

  2. flowchart LR; %%{init: {"flowchart": {"defaultRenderer": "elk"}} }%% repo{{Events}} 0[\Add Field/] 1[(Function)] result{{Result Set}} repo --> 0 0 --> 1 1 --> result style 0 fill:#ff0000,stroke-width:4px,stroke:#000;

    In a test event the field item is set to 4.

    logscale
    item := 4
  3. flowchart LR; %%{init: {"flowchart": {"defaultRenderer": "elk"}} }%% repo{{Events}} 0[\Add Field/] 1[(Function)] result{{Result Set}} repo --> 0 0 --> 1 1 --> result style 1 fill:#ff0000,stroke-width:4px,stroke:#000;

    Set the value of the target field foo as the result of the expression value of item + 10.

    logscale
    | setField(target="foo", value=item + 10)

  4. Event Result set

Summary and Results

fooitem
144

Setting values for multiple fields

Query
flowchart LR; %%{init: {"flowchart": {"defaultRenderer": "elk"}} }%% repo{{Events}} 0[\Add Field/] 1[\Add Field/] 2[(Function)] 3[(Function)] 4[(Function)] result{{Result Set}} repo --> 0 0 --> 1 1 --> 2 2 --> 3 3 --> 4 4 --> result
logscale
item := 4
| bar := "baz"
| setField(target=bar, value=item + 10)
| setField(target="foo", value=item + 20)
| setField(target="baaz", value=if(item == 4, then="OK", else="not OK"))
Introduction

Set the value of more fields as the result of several expressions.

Step-by-Step

  1. Starting with the source repository events

  2. flowchart LR; %%{init: {"flowchart": {"defaultRenderer": "elk"}} }%% repo{{Events}} 0[\Add Field/] 1[\Add Field/] 2[(Function)] 3[(Function)] 4[(Function)] result{{Result Set}} repo --> 0 0 --> 1 1 --> 2 2 --> 3 3 --> 4 4 --> result style 0 fill:#ff0000,stroke-width:4px,stroke:#000;

    In a test event where field item is set to 4:

    logscale
    item := 4
  3. flowchart LR; %%{init: {"flowchart": {"defaultRenderer": "elk"}} }%% repo{{Events}} 0[\Add Field/] 1[\Add Field/] 2[(Function)] 3[(Function)] 4[(Function)] result{{Result Set}} repo --> 0 0 --> 1 1 --> 2 2 --> 3 3 --> 4 4 --> result style 1 fill:#ff0000,stroke-width:4px,stroke:#000;

    Point field bar to field "baz":

    logscale
    | bar := "baz"
  4. flowchart LR; %%{init: {"flowchart": {"defaultRenderer": "elk"}} }%% repo{{Events}} 0[\Add Field/] 1[\Add Field/] 2[(Function)] 3[(Function)] 4[(Function)] result{{Result Set}} repo --> 0 0 --> 1 1 --> 2 2 --> 3 3 --> 4 4 --> result style 2 fill:#ff0000,stroke-width:4px,stroke:#000;

    Take field bar as the target, get the field pointed to by bar (baz) and set its value as the result of the expression value of item + 10.

    logscale
    | setField(target=bar, value=item + 10)
  5. flowchart LR; %%{init: {"flowchart": {"defaultRenderer": "elk"}} }%% repo{{Events}} 0[\Add Field/] 1[\Add Field/] 2[(Function)] 3[(Function)] 4[(Function)] result{{Result Set}} repo --> 0 0 --> 1 1 --> 2 2 --> 3 3 --> 4 4 --> result style 3 fill:#ff0000,stroke-width:4px,stroke:#000;

    Take field foo as the target, set its value as the result of the expression "value of item + 20":

    logscale
    | setField(target="foo", value=item + 20)
  6. flowchart LR; %%{init: {"flowchart": {"defaultRenderer": "elk"}} }%% repo{{Events}} 0[\Add Field/] 1[\Add Field/] 2[(Function)] 3[(Function)] 4[(Function)] result{{Result Set}} repo --> 0 0 --> 1 1 --> 2 2 --> 3 3 --> 4 4 --> result style 4 fill:#ff0000,stroke-width:4px,stroke:#000;

    Add an if() function whose condition will set the value of the new target field baaz: for example, if item is equal to 4, then the value of field baaz is OK, otherwise not OK.

    logscale
    | setField(target="baaz", value=if(item == 4, then="OK", else="not OK"))

  7. Event Result set

Summary and Results

We look at different target fields to set their values as the result of a given expression. Functions can be added as part of the expression in the value parameter, to determine the value of another target expression.

baazbarbarbazfooitem
OKbazbaz14244