String Query Functions
LogScale's string functions allow for string data within events to be extracted, combined or modified.
Table: String Query Functions
| Function | Default Argument | Availability | Description |
|---|---|---|---|
concat([as], field) | field | Â | Concatenates the values of a list of fields into a value in a new field. |
concatArray([as], field, [from], [prefix], [separator], [suffix], [to]) | field | Â | Concatenates values of all fields with same name and an array suffix into a new field. |
length([as], field) | field | Â | Computes the number of characters in a string field. |
lowercase(field, [include], [locale]) | field | Â | Changes field name or content to lowercase for parsers. |
regex([field], [flags], [limit], regex, [repeat], [strict]) | regex | Â | Extracts new fields using a regular expression. |
replace([as], [field], [flags], regex, [replacement], [with]) | regex | Â | Replaces each substring that matches given regular expression with given replacement. |
splitString([as], by, [field], [index]) | field | Â | Splits a string by specifying a regular expression by which to split. |
stripAnsiCodes([as], field) | field | Â | Removes ANSI color codes and movement commands. |
text:length([as], string) | string | added in 1.207 | Computes the length of a string. |
text:positionOf([as], [begin], character, [occurrence], string) | string | added in 1.207 | Computes the position of a given character or substring within a string. |
text:substring([as], [begin], [end], string) | string | added in 1.207 | Extracts a substring from a string given a pair of positions into the string. |
tokenHash([as], field) | field | Â | Calculates a hash by tokenizing the input string (split by spaces), creating a hash for each token and then added the result together. This generates the same hash value, even if the order of the individual values in the source string is different. |