Conditional event processing-Simple Log Service(SLS)-阿里云帮助中心

Conditional event processing lets you perform operations on data that meets specific criteria, improving the reliability of your data processing logic. The following examples show common scenarios and best practices for using functions in conditional event processing.

Check if a field exists

Raw log
```
{
 "a": "a_value"
}
```

SPL statement

| extend has_b= if(b is null,false, true)

Output
```
{
"a": "a_value",
"has_b": "false"
}
```

Check for non-empty fields

Raw log
```
{
"a": "a_value",
"b":""
}
```

SPL statement

| extend has_b = if(length(trim(b)) > 0, true, false)

Output
```
{
"a": "a_value",
"has_b": "false"
}
```

Apply logic based on field values

Add a type field to each log based on the values of the http_status and body_bytes_sent fields.
- For logs where the http_status value starts with 2 and the body_bytes_sent value is less than 1000, add a type field and set its value to normal.
- For logs where the http_status value starts with 2 and the body_bytes_sent value is 1000 or greater, add a type field and set its value to long warning.
- For logs where the http_status value starts with 3, add a type field and set its value to redirect.
- For logs where the http_status value starts with 4, add a type field and set its value to error.
- For all other logs, add a type field and set its value to others.

Raw logs

[
{
  "http_host": "example.com",
  "http_status": "200",
  "request_method":"GET",
  "body_bytes_sent":"740"
},
{
  "http_host": "example.com",
  "http_status": "200",
  "request_method":"POST",
  "body_bytes_sent":"1123"
},{
"http_host": "example.com",
  "http_status": "300",
  "request_method":"GET",
  "body_bytes_sent":"711"
},{
"http_host": "aliyundoc.com",
  "http_status": "404",
  "request_method":"GET",
  "body_bytes_sent":"1822"
},{
"http_host": "aliyundoc.com",
  "http_status": "500",
  "request_method":"GET",
  "body_bytes_sent":"100"
} 
]

SPL statement

* | extend type=(CASE
    WHEN http_status like '2%' AND  cast(body_bytes_sent as BIGINT) < 1000 then 'normal'
    WHEN http_status like '2%' AND  cast(body_bytes_sent as BIGINT) >= 1000 then 'long warning'
    WHEN http_status like '3%' then 'redirect'
    WHEN http_status like '4%' then 'error'
    ELSE 'others'
END)

Output

[
{
  "http_host": "example.com",
  "http_status": "200",
  "request_method":"GET",
  "body_bytes_sent":"740",
  "type":"normal"
},
{
  "http_host": "example.com",
  "http_status": "200",
  "request_method":"POST",
  "body_bytes_sent":"1123",
  "type":"long warning"
},{
"http_host": "example.com",
  "http_status": "300",
  "request_method":"GET",
  "body_bytes_sent":"711",
  "type":"redirect"
},{
"http_host": "aliyundoc.com",
  "http_status": "404",
  "request_method":"GET",
  "body_bytes_sent":"1822",
  "type":"error"
},{
"http_host": "aliyundoc.com",
  "http_status": "500",
  "request_method":"GET",
  "body_bytes_sent":"100",
  "type":"others"
} 
]