Event check functions

Functions

e_has

Checks whether a field exists.

• Syntax

  e_has("key")

• Parameters

  Parameter	Parameter type	Required	Description
  key	String	Yes	The name of the log field.

• Response

  Returns True if the field exists. Otherwise, it returns False.

• Examples

  Checks whether a log contains the content field. If the field exists, the log is kept. Otherwise, the log is dropped.

  • Raw log

    content: 123

  • Transformation rule

    e_keep(e_has("content"))

  • Result

    content: 123

e_not_has

Checks whether a field does not exist.

• Syntax

  e_not_has("key")

• Parameters

  Parameter	Parameter type	Required	Description
  key	String	Yes	The field name.

• Response

  Returns True if the field does not exist. Otherwise, it returns False.

• Examples

  Checks whether a log contains the content field. If the field does not exist, the log is kept. Otherwise, the log is dropped.

  • Raw log

    content: 123

  • Transformation rule

    e_if_else(e_not_has("content"),KEEP,DROP)

  • Result

    The log is dropped.

• More information

  This function can be used with other functions. For more information, see Use functions to cleanse data.

e_search

Provides a simplified, Lucene-like syntax for event searches.

• Syntax

  e_search(querystring)

• Parameters

  Parameter	Parameter type	Required	Description
  querystring	String	Yes	The query string used to quickly filter logs. For more information, see Query string syntax.

• Response

  Returns True if the condition is met. Otherwise, it returns False.

• Examples

  # Full-text search
  e_search("active error")     # Full-text search: The two substrings are searched with an OR relationship.
  e_search('"active error"')   # Full-text search: Search for a single substring.
  
  # Field:String
  e_search("status: active")         # Word search.
  e_search('author: "john smith"')   # Substring search with spaces.
  e_search('field: active error')   # Equivalent to field:active OR "error".
  
  # Exact match
  e_search('author== "john smith"')  
  
  # Wildcard search. An asterisk (*) matches zero or more characters. A question mark (?) matches a single character.
  e_search("status: active*test")    # active*test contains only an asterisk (*). You do not need to enclose it in double quotation marks ("").
  e_search("status: active?good")    # active?good contains only a question mark (?). You do not need to enclose it in double quotation marks ("").
  e_search("status== ac*tive?good")  # Exact match.
  
  # Escape search values. Asterisks (*) or question marks (?) must be escaped with a backslash (\).
  e_search('status: "\*\?()[]:="')  # \*\?()[]:= contains special characters and must be enclosed in double quotation marks (""). Only asterisks (*), question marks (?), and backslashes (\) need to be escaped.
  e_search("status: active\*test")  # active\*test contains only an asterisk (*). You do not need to enclose it in double quotation marks ("").
  e_search("status: active\?test")  # active\?test contains only a question mark (?). You do not need to enclose it in double quotation marks ("").
  
  # Escape field names
  e_search("\*\(1+1\)\?: abc")                  # Field names cannot be enclosed in double quotation marks (""). Escape special characters with a backslash (\).
  e_search("__tag__\:__container_name__: abc")  # Escape with a backslash (\).
  e_search("Chinese_field: abc")                     # Write Chinese characters directly.
  
  # Regular expression match
  e_search('content~="regular_expression"')   # Regular expression match.
  
  # Numbers
  e_search('count: [100, 200]')   # >=100 and <=200
  e_search('count: [*, 200]')     # <=200
  e_search('count: [200, *]')     # >=200
  e_search('age >= 18')           # >= 18
  e_search('age > 18')            # > 18
  
  # Use relational operators
  e_search("abc OR xyz")    # Relational operators are case-insensitive. OR and or have the same effect.
  e_search("abc and (xyz or zzz)")
  e_search("abc and not (xyz and not zzz)")
  e_search("abc && xyz")    # and
  e_search("abc || xyz")    # or
  e_search("abc || !xyz")   # or not

• More information

  This function can be used with other functions. For more information, see Use functions to cleanse data.

e_match

Checks whether the value of a log field matches a regular expression.

• Syntax

  e_match(key, regular_expression, full=True)

  Note

  The e_match function is often used with op_not, op_and, or op_or.

• Parameters

  Parameter Name	Parameter type	Required	Description
  key	String	Yes	The field name. If the field does not exist, the sub-condition is not met. For example, if the f1 field does not exist, the e_match("f1", ...) function returns False.
  regular_expression	String	Yes	The regular expression. To match a literal string instead of using a regular expression, use the str_regex_escape function to modify the regular expression.
  full	Bool	No	Specifies whether to perform a full match. The default is True, which indicates a full match. For more information about matching modes, see Regular expressions.

• Response

  Returns True or False based on the matching result.

• Examples

  Checks whether the value of the k1 field is a number.

  • Raw log

    k1: 123

  • Transformation rule

    e_set("match",e_match("k1",r'\d+'))

  • Result

    k1: 123
    match: True

• More information

  This function can be used with other functions. For more information, see Use functions to cleanse data.

e_match_any

Checks if the value of any specified log field matches a corresponding regular expression. Returns True if any field matches. Otherwise, returns False.

• Syntax

  e_match_any(key1, regular_expression1, key2, regular_expression2, ..., full=True)

  Note

  • The key and regular_expression parameters must appear in pairs.

  • The e_match_any function is often used with op_not, op_and, or op_or.

• Parameters

  Parameter Name	Parameter Type	Required	Description
  key	String	Yes	The field name. If the field does not exist, the sub-condition is not met. For example, if the f1 field does not exist, the e_match_any("f1", ...) function returns False.
  regular_expression	String	Yes	The regular expression pattern. To match a literal string instead of using a regular expression, use the str_regex_escape function to modify the regular expression.
  full	Bool	No	Specifies whether to perform a full match. The default is True, which indicates a full match. For more information about matching modes, see Regular expressions.

• Response

  Returns True or False based on the matching result.

• Examples

  The e_match_any function returns True if any field matches its corresponding regular expression.

  • Raw log

    k1: 123
    k2: abc
    k3: abc123

  • Transformation rule

    e_set("match",e_match_any('k1', r'\d+', 'k2', '.+'))

  • Result

    k1:123
    k2:abc
    k3:abc123
    match:true

• More information

  This function can be used with other functions. For more information, see Use functions to cleanse data.

e_match_all

Checks if the value of every specified log field matches a corresponding regular expression. Returns True if all fields match. Otherwise, returns False.

• Syntax

  e_match_all(key1, regular_expression1, key2, regular_expression2, ..., full=True)

  Note

  • The key and regular_expression parameters must appear in pairs.

  • The e_match_all function is often used with op_not, op_and, or op_or.

• Parameters

  Parameter name	Parameter Type	Required	Description
  Field name	String	Yes	The field name. If the field does not exist, the sub-condition is not met. For example, if the f1 field does not exist, the e_match_all("f1", ...) function returns False.
  Regular expression	String	Yes	The regular expression pattern. To match a literal string instead of using a regular expression, use the str_regex_escape function to modify the regular expression.
  full	Bool	No	Specifies whether to perform a full match. The default is True, which indicates a full match. For more information about matching modes, see Regular expressions.

• Response

  Returns True or False based on the matching result.

• Examples

  • Raw log

    k1: 123
    k2: abc
    k3: abc123

  • Transformation rule

    e_set("match", e_match_all("k1", r"\d+", "k2", r"\d+"))

  • Result

    k1:123
    k2:abc
    k3:abc123
    match:false

• More information

  This function can be used with other functions. For more information, see Use functions to cleanse data.