Get the Value of a Field Stored in Another Field

Query

logscale
result := getField("foo")

Introduction

Given an event with the following fields:

|------------------|
| foo      | bar   |
| bar      | 123   |
| foo      | quux  |
|------------------|

Do a "direct" lookup where the result is set to the value that is stored in that field, by quoting the string — it takes expressions as input (similar to eval() and test() functions):

Step-by-Step

  1. Starting with the source repository events.

  2. flowchart LR; %%{init: {"flowchart": {"defaultRenderer": "elk"}} }%% repo{{Events}} 0[/Filter/] result{{Result Set}} repo --> 0 0 --> result style 0 fill:#ff0000,stroke-width:4px,stroke:#000;
    logscale
    result := getField("foo")

    The result is set to the value that is stored in field foo

  3. Event Result set.

Summary and Results

barfooresult
123barbar
<no value>quuxquux

In the same event, using the same query that does not quote the string:

logscale
result := getField(foo)

will get the value of the field which name is stored at foo, so 123 is stored as the result:

barfooresult
123bar123
<no value>quux<no value>

(no result is output for foo=quux as quux does not exist).