Create Two Temporary Events for Troubleshooting - Example 1
Create two temporary events for testing or troubleshooting using the createEvents()
function
Query
createEvents(["animal=dog weight=7.0", "animal=cat weight=4.2"])
Introduction
The createEvents()
function generates
temporary events as part of the query. The function is ideal for
generating sample data for testing or troubleshooting.
Example incoming data might look like this:
animal=dog weight=7.0 |
---|
animal=cat weight=4.2 |
Step-by-Step
Starting with the source repository events.
- flowchart LR; %%{init: {"flowchart": {"defaultRenderer": "elk"}} }%% repo{{Events}} 0[\Add Field/] result{{Result Set}} repo --> 0 0 --> result style 0 fill:#ff0000,stroke-width:4px,stroke:#000;logscale
createEvents(["animal=dog weight=7.0", "animal=cat weight=4.2"])
Creates two temporary events to be used for testing purposes. An event with
dog
and an event withcat
. Event Result set.
Summary and Results
The query is used to create temporary events. The
createEvents()
function can be combined
with different parsers to generate more interesting events, for
example, with kvParse()
or
parseJson()
.
Sample output from the incoming example data:
@rawstring | @timestamp | @timestamp.nanos |
---|---|---|
animal=dog weight=7.0 | 1733310508872 | 0 |
animal=cat weight=4.2 | 1733310508872 | 0 |