Set the Value of a Field

Query

logscale
item := 4
| setField(target="foo", value=item + 10)

Introduction

Set the value of a target field as the result of an expression. This is equivalent to:

logscale
item := 4
| foo := item + 10

Step-by-Step

  1. Starting with the source repository events.

  2. flowchart LR; %%{init: {"flowchart": {"defaultRenderer": "elk"}} }%% repo{{Events}} 0[\Add Field/] 1[(Function)] result{{Result Set}} repo --> 0 0 --> 1 1 --> result style 0 fill:#ff0000,stroke-width:4px,stroke:#000;
    logscale
    item := 4

    In a test event the field item is set to 4.

  3. flowchart LR; %%{init: {"flowchart": {"defaultRenderer": "elk"}} }%% repo{{Events}} 0[\Add Field/] 1[(Function)] result{{Result Set}} repo --> 0 0 --> 1 1 --> result style 1 fill:#ff0000,stroke-width:4px,stroke:#000;
    logscale
    | setField(target="foo", value=item + 10)

    Sets the value of the target field foo as the result of the expression value of item + 10.

  4. Event Result set.

Summary and Results

fooitem
144