parseFixedWidth() Query Function

Parse a fixed width-encoded field into known columns. It can parse values of the form:

humio
value 1 value 2 value 3, widths [8,8,8]
value 1value 2value 3, widths [7,7,7]

For a log line like this:

humio
2017-02-22T13:14:01.917+0000 [main thread] INFO statsModule got result="117success 27% 3.14"

Using parseFixedWidth(result, columns=[count, status, completion, precision, sourcetask], widths=[3,9,4,10,10) will add these fields:

humio
count: 117
status: success
completion: 27%
precision: 3.14

Sourcetask will not get assigned a value, as there were too few columns in the input for that. Values are trimmed after they have been extracted, i.e. success will become success from the above example.

Use the (unnamed) field parameter to specify which field should be parsed. Specify @rawstring to parse the raw string

Parameters

Name

Type

Required

Default

Description

field

string

No

@rawstring

Field that holds the input in fixed width form.

columns

[string]

Yes

Names of columns to extract from field.

widths

[number]

Yes

Widths of columns.

trim

boolean

No

true

Remove leading and trailing white-space from fields after extracting.

The implied parameter is field.

Examples

Fixed width parse the result field from a log line: statsModule got result="117success 27% 3.14". This will add the fields count=117, status=success', completion=27%andprecision=3.14 to the event. sourcetask will not get set as the input is too short.

humio
parseFixedWidth(result, columns=[count, status, completion, precision, sourcetask], widths=[3,9,4,10,10])