Decodes an integer to its bit-representation and extracts the bits at specified indices to specified field names as a boolean.

The bits are indexed from 0 and can accept up to 64 bits (the length of a Long). If the value in the input field is larger, the lowest 64 bits will be used.

ParameterTypeRequiredDefault ValueDescription
fieldstringrequired  The name of the field that should be decoded.
onlyTruebooleanoptional[a]false If set to true, fields will only be added if their value in the bitfield is true; any flags that are false will not be added.
outputstringrequired  A list of pairs of indices in the bit-representation and the field name it should be written to.

[a] Optional parameters use their default value unless explicitly set.

Decode and Extract Bit Flags

Extract truebits flags using the bitfield:extractFlags() function

Query
logscale
bitfield:extractFlags(field="MemoryDescriptionFlags", onlyTrue=true, output=[
  [0,INVALID_ADDRESS],
  [1,CURRENT_STACK],
  [2,JIT_DOTNET],
  [3,MZ],
  [4,CODE],
  [5,MODULE],
  [6,MAPPED],
  [7,REFLECIVE_PE],
  [8,JIT_FLASH],
  [9,PRIMARY_MODULE],
  [10,PRIVATE_MEMORY],
  [11,KNOWN_FUNCTION],
  [12,FREE_MEMORY]])
Introduction

The bitfield:extractFlags() function can be used to decode an integer to its bit-representation and extract the true bits at specified indices with specified names. The fields will be named with the names of the set bits. The bits are indexed from 0 and will include up to 64 bits. If the value in the input field is larger, the lowest 64 bits will be used. In this example, the bitfield:extractFlags() function is used to decode the field MemoryDescriptionFlags and extract its true bits.

Example incoming data might look like this:

Raw Events
MemoryDescriptionFlags,1234
// corresponds to 10011010010

Step-by-Step

  1. Starting with the source repository events.

  2. logscale
    bitfield:extractFlags(field="MemoryDescriptionFlags", onlyTrue=true, output=[
  [0,INVALID_ADDRESS],
  [1,CURRENT_STACK],
  [2,JIT_DOTNET],
  [3,MZ],
  [4,CODE],
  [5,MODULE],
  [6,MAPPED],
  [7,REFLECIVE_PE],
  [8,JIT_FLASH],
  [9,PRIMARY_MODULE],
  [10,PRIVATE_MEMORY],
  [11,KNOWN_FUNCTION],
  [12,FREE_MEMORY]])

    Decodes the field MemoryDescriptionFlags and extracts the true bits at specified indices with specified names. The fields will be named with the names of the set bits.

  3. Event Result set.

Summary and Results

The query is used to decode an integer to its bit-representation and extract the true bits at specified indices with specified names.

Sample output from the incoming example data:

CODECURRENT_STACKFREE_MEMORYINVALID_ADDRESSJIT_DOTNETJIT_FLASHKNOWN_FUNCTIONMAPPEDMODULEMZPRIMARY_MODULEPRIVATE_MEMORYREFLECIVE_PE
truetruefalsefalsefalsefalsefalsetruefalsefalsefalsetruetrue