Event Information Query Functions
LogScale's event information functions allow event information and field selection. These are designed to work with event fields, rather than the data within the event.
Table: Event Information Query Functions
| Function | Default Argument | Availability | Description |
|---|---|---|---|
copyEvent(type) | type | Â | Duplicates an event so that the pipeline will see both events. |
createEvents(rawstring) | rawstring | Â | Generates temporary events as part of the query. |
default(field, [replaceEmpty], value) | value | Â | Creates a field to given parameter and given value. |
drop(fields) | fields | Â | Removes specified fields from each event. |
dropEvent() | Â | Â | Drops completely an event in parser pipeline to stop it from being ingested. |
eventFieldCount([as]) | Â | Â | Computes number of fields event uses internally for the values. |
eventInternals([prefix]) | Â | Â | Add a set of fields describing the storage locations of this event. |
eventSize([as]) | Â | Â | Determines the number of bytes that this event uses internally for the values, not counting the bytes for storing the field names. |
fieldset() | Â | Â | Retrieves a list of available fields. |
fieldstats([limit]) | Â | Â | Displays statistics about fields. |
hash([as], field, [limit], [seed]) | field | Â | Computes a non-cryptographic hash of a list of fields. |
readFile(file, [include], [limit]) | file | Â |
Uses a .csv lookup file or ad-hoc table as
data input for the query.
|
rename([as], field) | field | Â | Renames one or more given fields. |
select(fields) | fields | Â | Used to specify a set of fields to select from each event. |
test(expression) | expression | Â | Evaluates boolean expression and filters events. |