Basic syntax

Comments

# Set the default topic for logs. This is a comment at the beginning of a line.
e_set("__topic__", "access_log")   # Set the default topic for logs. This is a comment at the end of a line.

Line breaks

e_set("__topic__", "v1",
        "type", "v2",       # When parameters are separated by commas (,), you can add a line break directly.
        "length", 100)
e_set("__topic__", "this is a very long long long .........." \
                            "......long text")  # Use a backslash (\) to add a line break.

Function invocation methods

• Basic invocation

  e_set("abc", "xyz")

  Note

  When you write a data transformation statement, the data types and number of input parameters must match the function syntax.

• Basic variable parameter invocation

  str_replace(value, old [,new [,count] ]) 

  Note

  If a function's parameters include square brackets ([]), the parameters within the brackets, such as new and count, are optional. You cannot call them as named parameters and must call them in the specified sequence.

  # Invalid examples
  str_replace("a-b-c", "-", new='%')
  str_replace("a-b-c", "-", new='%', count=1)
  # Valid examples
  str_replace("a-b-c", "-", '%')
  str_replace("a-b-c", "-", '%', 2)

• Named parameter invocation

  A parameter with a default value is a named parameter. For example, mode in e_set("abc", "xyz", mode="fill") is a named parameter.

  • For some functions, you must pass values for named parameters under specific conditions. For more information, see the parameter description for each function.

  • To pass a value to a named parameter, use the format: mode=....

  • If there are multiple named parameters, the order in which you specify them does not matter. For example, e_csv("data", ["f1", "f2", "f3"], sep='#', quote="|") is the same as e_csv("data", ["f1", "f2", "f3"], quote="|", sep='#').

  Note

  In a function call, named parameters must always be specified after non-named parameters.

• Nested function calls

  You can use the return value of one function as a parameter in another function. Ensure that the data types are consistent. For example:

  e_set("abc", v("xyz"))
  e_set("abc", str_lower(v("xyz")))

• Variable parameters

  Some functions support variable parameters. v("f1", ....) indicates that you can pass more parameters, such as v("f1", "f2", "f3").

  When you pass named parameters, they must be placed at the end. For example, v("f1", "f2", "f3", "f4", mode="fill").

Operators

• Comparison operators

  The standard mode of SLS DSL supports comparison operators, including >, <, >=, <=, !=, and ==. You can also use the comparison functions provided by SLS to achieve the same effect.

  • Use comparison operators directly

    # The following examples show how to use comparison operators. If the comparison result is True, the log is dropped.
    e_if(3 > 2, DROP)       # If 3 is greater than 2, the log is dropped.
    e_if(3 < 2, DROP)       # If 3 is less than 2, the log is dropped.
    e_if(3 >= 2, DROP)      # If 3 is greater than or equal to 2, the log is dropped.
    e_if(3 <= 2, DROP)      # If 3 is less than or equal to 2, the log is dropped.
    e_if(3 == 2, DROP)      # If 3 is equal to 2, the log is dropped.
    e_if(3 != 2, DROP)      # If 3 is not equal to 2, the log is dropped.
    e_if(1 < 2 < 3, DROP)   # If 2 is greater than 1 and less than 3, the log is dropped.
    e_if(0 < ct_int(v('x')) < 100, DROP) # If the value of the x field is greater than 0 and less than 100, the log is dropped.

  • Use the comparison functions provided by SLS

    Operation	Function	Example
    Equal to ==	op_eq	op_eq(v("name"), "xiao ming")
    Not equal to !=	op_ne	op_ne(v("name"), "xiao ming")
    Greater than >	op_gt	op_gt(ct_int(v("age")))
    Greater than or equal to >=	op_ge	op_ge(ct_int(v("age")), 18)
    Less than <	op_lt	op_lt(ct_int(v("age")), 18)
    Less than or equal to <=	op_le	op_le(ct_int(v("age")), 18)

• Logical operators

  The standard mode of SLS DSL supports logical operators, including and, or, and not. You can also use the logical functions provided by SLS to achieve the same effect.

  • Use logical operators directly

    # The following examples show how to use logical operators. If the result of the logical operation is True, the log is dropped.
    e_if(True and False, DROP)     # The result is False.
    e_if(True or False, DROP)      # The result is True.
    e_if(True and not False, DROP) # The result is True.
    e_if(3 > 2 and 1 < 3, DROP)    # The result is True.
    e_if(ct_int(v('x')) > 100 or ct_int(v('y')) < 100, DROP) # The value of the x field is greater than 100 or the value of the y field is less than 100.

  • Use the logical functions provided by SLS

    Operation	Function	Example
    Logical AND and	op_and	op_and(op_gt(v("age"), 18), op_lt(v("age"), 31))
    Logical OR or	op_or	op_or(op_le(v("age"), 18), op_gt(v("age"), 65))
    Logical NOT not	op_not	op_not(op_gt(v("age"), 18))

• Other operators

  The following operators are not directly supported in the standard mode of SLS DSL. SLS provides corresponding functions to achieve the same effects.

  Scenario-based operations	Function	Example
  Add +	op_add	op_add(v("age"), 2)
  Subtraction -	op_sub	op_sub(v("age"), 2)
  Multiplication *	op_mul	op_mul(v("size"), 2)
  Exponentiation **	op_pow	op_pow(v("size"), 2)
  Floor division //	op_div_floor	op_div_floor(v("bytes"), 1024)
  Modulo operation %	op_mod	op_mod(v("age"), 10)
  Negation -	op_neg	op_neg(v("profit"))
  Check for existence in	op_in	op_in(["pass", "ok"], v("result"))
  Check for non-existence not in	op_not_in	op_not_in(["pass", "ok"], v("result"))
  String slicing [ ...]	op_slice	op_slice(v("message"), 0, 20)

  For example, to set the value of the a field to 3600*6:

  # * 
  e_set("a", 3600 * 6)           # Invalid
  e_set("a", op_mul(3600, 6))    # Valid
  
  # /
  e_set("bytes_kb", v("bytes") / 1024)                 # Invalid
  e_set("bytes_kb", op_div_floor(v("bytes"), 1024))    # Valid

True and false evaluation

Some functions accept a condition and determine the subsequent logic based on the value of that condition. The condition can be a static field or the return value of an expression.

e_if(True, DROP)                     # If the input is True, the event is dropped.
e_if(1, DROP)                        # If the input is 1, the event is dropped.
e_if(v("abc"), DROP)                 # If the abc field exists and is not empty, the event is dropped.
e_if(str_isdigit(v("abc")), DROP)    # If the abc field exists and its content consists only of digits, the event is dropped.