Parse a fixed width-encoded field into known columns. It can parse values of the form:
value 1 value 2 value 3, widths [8,8,8]
value 1value 2value 3, widths [7,7,7]
Parameter | Type | Required | Default Value | Description |
---|---|---|---|---|
columns | Array of strings | required | Names of columns to extract from field. | |
field [a] | string | optional[b] | @rawstring | Field that holds the input in fixed width form. |
trim | boolean | optional[b] | true | Remove leading and trailing white-space from fields after extracting. |
widths | Array of numbers | required | Widths of columns. | |
[b] Optional parameters use their default value unless explicitly set. |
Hide omitted argument names for this function
Omitted Argument NamesThe argument name for
field
can be omitted; the following forms of this function are equivalent:logscaleparseFixedWidth("field",columns=["value"],widths=[10])
and:
logscaleparseFixedWidth(field="field",columns=["value"],widths=[10])
These examples show basic structure only.
For a log line like this:
2017-02-22T13:14:01.917+0000 [main thread] INFO statsModule got result="117success 27% 3.14"
Using parseFixedWidth(result, columns=[count,
status, completion, precision, sourcetask], widths=[3,9,4,10,10)
will add these fields:
count: 117
status: success
completion: 27%
precision: 3.14
Sourcetask will not get assigned a value, as there were too few columns in the input for that. Values are trimmed after they have been extracted, for example, success will become success from the above example.
Use the (unnamed) field parameter to specify which field should be parsed. Specify @rawstring to parse the raw string
parseFixedWidth()
Examples
Fixed width parse the result field from a log line:
statsModule got result="117success 27% 3.14
The query:
parseFixedWidth(result, columns=[count, status, completion, precision, sourcetask], widths=[3,9,4,10,10])
will add the following fields to the event:
count=117
status=success
completion=27%
precision=3.14
sourcetask will not get set as the input is too short.