Global operation functions

Function type

Function

Instructions

Flow control functions

e_if

You can combine multiple conditions and operations.

e_if_else

Performs an operation based on the evaluation result of a specified condition.

e_switch

A combination of conditions and operations. After one condition is met, the operation is performed and the process exits.

e_compose

Combines multiple operations and performs the operations in sequence.

Event operation functions

e_drop

Discards a log if a specified condition is met.

e_keep

Retains a log if a specified condition is met.

e_split

Splits a log into multiple logs based on the value of a specified field. The function also supports extracting the field value using JMESPath before splitting.

e_output

Writes a log to a specified Logstore. The subsequent transformation rules are not executed for the log.

e_coutput

Writes a log to a specified Logstore. The subsequent transformation rules are still executed for the log.

e_to_metric

Converts the log format to the time series storage (MetricStore) format.

Field operation functions

v

Gets the value of a specific log field.

e_set

Adds a new field or sets a new value for an existing field.

e_drop_fields

Deletes log fields that meet a specified condition.

e_keep_fields

Retains log fields that meet a specified condition.

e_pack_fields

Packs log fields and outputs them to a new field.

e_rename

Renames log fields that meet a specified condition.

Field value extraction functions

e_regex

Extracts the value of a field using a regular expression and assigns the value to other fields.

e_json

Performs JSON operations on a JSON object in a specified field. Operations include expanding JSON data, extracting data using JMES, or extracting and then expanding the data.

e_kv

Extracts key-value pairs from multiple source fields using quotes.

e_kv_delimit

Extracts key-value pairs from source fields using a separator.

e_csv

Extracts multiple fields using a comma (,) as the default separator.

e_tsv

Extracts multiple fields using a tab (\t) as the default separator.

e_psv

Extracts multiple fields using a vertical bar (|) as the default separator.

e_syslogrfc

Calculates facility and severity from a known priority value based on the Syslog protocol, and matches the corresponding level information.

e_anchor

Extracts strings using the rules specified by anchor_rules.

Mapping and enrichment functions

e_dict_map

Maps an input field to a new field based on a mapping dictionary.

e_table_map

Finds the corresponding row in a mapping table and returns a field value based on the input field.

e_tablestore_map

Enriches a raw log using data from Tablestore as a dimension table.

e_redis_map

Enriches a raw log using data from Alibaba Cloud Redis as a dimension table.