Computes the number of characters in a string field.
Hide omitted argument names for this function
Omitted Argument NamesThe argument name for
fieldcan be omitted; the following forms of this function are equivalent:logscale Syntaxlength("value")and:
logscale Syntaxlength(field="value")These examples show basic structure only.
length() Examples
Click next to an example below to get the full details.
Count Characters in Field
Count the number of characters in a field using the
length() function
Query
length(@rawstring)Introduction
In this example, the length() function is
used to count the number of characters in the
@rawstring field and
output the result in a field named
_length.
Example incoming data might look like this:
| @timestamp | @rawstring |
|---|---|
| 2025-02-24T08:00:01.000Z | User authentication failed: Invalid credentials |
| 2025-02-24T08:00:02.000Z | Connection established from 192.168.1.100 |
| 2025-02-24T08:00:03.000Z | Database backup completed successfully! |
| 2025-02-24T08:00:04.000Z | Error 404: Page not found |
| 2025-02-24T08:00:05.000Z | New user account created: john.doe@example.com |
| 2025-02-24T08:00:06.000Z | CPU usage spike detected: 95% |
| 2025-02-24T08:00:07.000Z | Firewall rule updated - blocking port 8080 |
| 2025-02-24T08:00:08.000Z | System shutdown initiated by administrator |
Step-by-Step
Starting with the source repository events.
- logscale
length(@rawstring)Counts the number of characters in the field @rawstring field and outputs the result in a field named _length. This count includes all visible characters, spaces, and punctuation marks in the log entry.
Using the
asparameter, it is also possible to define another output field, for example, rawLength, if adding the following:length(@rawstring, as="rawLength") Event Result set.
Summary and Results
The query is used to make a count of all characters (all visible characters, spaces, and punctuation marks) in a log entry. Making a count of all characters is useful for managing and analyzing, for example, security logs, ensuring complete data capture for threat detection and incident response.
Sample output from the incoming example data:
| @rawstring | _length |
|---|---|
| User authentication failed: Invalid credentials | 45 |
| Connection established from 192.168.1.100 | 41 |
| Database backup completed successfully! | 36 |
| Error 404: Page not found | 24 |
| New user account created: john.doe@example.com | 45 |
| CPU usage spike detected: 95% | 29 |
| Firewall rule updated - blocking port 8080 | 42 |
| System shutdown initiated by administrator | 41 |
Note that the _length field shows the total character count for each @rawstring value, including spaces and punctuation marks.