String Query Functions
Humio's query functions take a set of events, parameters, or configurations; and produce, reduce, or modify values within that set, or within the events themselves within the query pipeline.
Table: String Query Functions
| Function | Implied Argument | Availability | Description |
|---|---|---|---|
concat([as], field) | field | Concatenates the values of a list of fields into a value in a new field. | |
concatArray([as], field, [from], [prefix], [separator], [suffix], [to]) | field | Concatenates values of all fields with same name and an array suffix into a new field. | |
length([as], field) | field | Returns the number of characters in a string field. | |
lowercase(field, [include], [locale]) | field | Changes field name or content to lowercase for parsers. | |
match([column], field, file, [glob], [ignoreCase], [include], [mode], [strict]) | file | Searches text using a CSV or JSON file and can enhance entries. | |
regex([field], [flags], [limit], regex, [repeat], [strict]) | regex | Extracts new fields using a regular expression. | |
replace([as], [field], [flags], regex, [replacement], [with]) | field | Replaces each substring that matches given regular expression with given replacement. | |
split([field], [strip]) | field | Splits an event structure created by a JSON array into distinct events. | |
splitString([as], by, [field], [index]) | field | Splits a string by specifying a regular expression by which to split. | |
stripAnsiCodes([as], field, [type]) | field | Removes ANSI color codes and movement commands. | |
tokenHash([as], field) | field | Calculates a structure hash which is equal for similarly structured input. | |
transpose([column], [header], [limit], [pivot]) | pivot | Transposes a query results set by creating an event for each attribute. |