Formatting Query Functions

LogScale's formatting functions allow different data types to be formatted and manipulated, either for further processing or make things more human-readable.

Table: Formatting Query Functions

FunctionDefault ArgumentAvailabilityDescription
format([as], field, format, [timezone])format  Formats a string using printf-style.
formatDuration([as], field, [from], [precision])field  Formats a duration into a more readable string.
formatTime(as, [field], format, [locale], [timezone], [unit])format  Formats a string according to strftime().
json:prettyPrint([as], [field], [step], [strict])field  Nicer output to a JSON field.
lookup(from, [include], on)fromremoved in 1.30.0 Enhances events with metadata.
lower([as], field, [locale], [type])field  Changes text of a given string field to lower-case letters.
lowercase(field, [include], [locale])field  Changes field name or content to lowercase for parsers.
upper([as], field, [locale])field  Changes contents of a string field to upper-case letters.
writeJson([as], [field])field  Writes data, including fields, as a JSON object.