Generates temporary events as part of the query and is ideal for generating sample data for testing or troubleshooting. It is regarded as an aggregator function and, therefore, discards all incoming events and outputs the generated ones. The events are generated with no extracted fields but createEvents() can, advantageously, be combined with one of the many parsers. For example, given raw strings in the format of key/value pairs, the pairs can be parsed to fields using the kvParse() function.

ParameterTypeRequiredDefault ValueDescription
rawstring[a]stringrequired  Specification of events to emit. Each event is given as a @rawstring which is not processed further.

[a] The parameter name rawstring can be omitted.

Hide omitted argument names for this function

Show omitted argument names for this function

Click + next to an example below to get the full details.

Create Two Temporary Events for Troubleshooting - Example 1

Create two temporary events for testing or troubleshooting using the createEvents() function

Query
logscale
createEvents(["animal=dog weight=7.0", "animal=cat weight=4.2"])
Introduction

The createEvents() function generates temporary events as part of the query. The function is ideal for generating sample data for testing or troubleshooting.

Example incoming data might look like this:

Raw Events
animal=dog weight=7.0
animal=cat weight=4.2
Step-by-Step

  1. Starting with the source repository events.

  2. logscale
    createEvents(["animal=dog weight=7.0", "animal=cat weight=4.2"])

    Creates two temporary events to be used for testing purposes. An event with dog and an event with cat.

  3. Event Result set.

Summary and Results

The query is used to create temporary events. The createEvents() function can be combined with different parsers to generate more interesting events, for example, with kvParse() or parseJson().

Sample output from the incoming example data:

@rawstring@timestamp@timestamp.nanos
animal=dog weight=7.017333105088720
animal=cat weight=4.217333105088720

Create Two Temporary Events for Troubleshooting - Example 2

Create two temporary events for testing or troubleshooting using the createEvents() function with parseJson()

Query
logscale
createEvents(["{\"animal\":{\"kind\":\"dog\", \"weight\":7.0}}", "{\"animal\":{\"kind\":\"cat\", \"weight\":4.2}}"])
        | parseJson()
Introduction

The createEvents() function generates temporary events as part of the query. The function is ideal for generating sample data for testing or troubleshooting. In this example, the createEvents() function is combined with parseJson() to parse @rawstring as JSON.

Example incoming data might look like this:

Raw Events
{"animal":{"kind":"dog", "weight":7.0}}
{"animal":{"kind":"cat", "weight":4.2}}
Step-by-Step

  1. Starting with the source repository events.

  2. logscale
    createEvents(["{\"animal\":{\"kind\":\"dog\", \"weight\":7.0}}", "{\"animal\":{\"kind\":\"cat\", \"weight\":4.2}}"])

    Creates two temporary events. An event with dog and an event with cat.

  3. logscale
    | parseJson()

    Parses specified fields as JSON.

  4. Event Result set.

Summary and Results

The query is used to create temporary events and parse the @rawstring as JSON.

Sample output from the incoming example data:

@rawstring@timestamp@timestamp.nanosanimal.kindanimal.weight
{"animal":{"kind":"dog", "weight":7.0}}17333115477170dog7.0
{"animal":{"kind":"cat", "weight":4.2}}17333115477170cat4.2

Create Two Temporary Events for Troubleshooting - Example 3

Create two temporary events for testing or troubleshooting using the createEvents() function with kvParse()

Query
logscale
createEvents(["animal=dog weight=7.0", "animal=cat weight=4.2"])
        | kvParse()
Introduction

The createEvents() function generates temporary events as part of the query. The function is ideal for generating sample data for testing or troubleshooting. In this example, the createEvents() function is combined with kvParse() to parse @rawstring as JSON.

Example incoming data might look like this:

Raw Events
animal=dog weight=7.0
animal=cat weight=4.2
Step-by-Step

  1. Starting with the source repository events.

  2. logscale
    createEvents(["animal=dog weight=7.0", "animal=cat weight=4.2"])

    Creates two temporary events. An event with dog and an event with cat.

  3. logscale
    | kvParse()

    Parses the string into key value pairs.

  4. Event Result set.

Summary and Results

The query is used to create temporary events and parse the @rawstring as key value pairs.

Sample output from the incoming example data:

animalweight
dog7.0
cat4.2