Set Values for Multiple Fields

Assign multiple field values using the setField() function

Query

logscale
item := 4
| bar := "baz"
| setField(target=bar, value=item + 10)
| setField(target="foo", value=item + 20)
| setField(target="baaz", value=if(item == 4, then="OK", else="not OK"))

Introduction

Set the value of more fields as the result of several expressions.

Step-by-Step

  1. Starting with the source repository events.

  2. logscale
    item := 4

    In a test event where field item is set to 4:

  3. logscale
    | bar := "baz"

    Points field bar to field "baz":

  4. logscale
    | setField(target=bar, value=item + 10)

    Takes field bar as the target, gets the field pointed to by bar (baz) and sets its value as the result of the expression value of item + 10.

  5. logscale
    | setField(target="foo", value=item + 20)

    Takes field foo as the target, sets its value as the result of the expression "value of item + 20":

  6. logscale
    | setField(target="baaz", value=if(item == 4, then="OK", else="not OK"))

    Adds an if() function whose condition will set the value of the new target field baaz: for example, if item is equal to 4, then the value of field baaz is OK, otherwise not OK.

  7. Event Result set.

Summary and Results

We look at different target fields to set their values as the result of a given expression. Functions can be added as part of the expression in the value parameter, to determine the value of another target expression.

baazbarbarbazfooitem
OKbazbaz14244