Calculated Fields Expression Language

Docs > Gestión de logs > Log Explorer > Calculated Fields > Calculated Fields Expression Language

This page is not yet available in Spanish. We are working on its translation.
If you have any questions or feedback about our current translation project, feel free to reach out to us!

Basic syntax and language constructs

Construct	Syntax and Notation
Reserved attribute or tag named `tag`	`tag` (no prefix required)
Attribute named `attr`	`@attr` (use an `@` prefix)
Calculated field named `field`	`#field` (use a `#` prefix)
String literal (quote) For example, `text` or `Quoted "text"`.	`"text"` `"Quoted \"text\""` (Log Search Syntax applies)
Numeric literal (number) For example, `ten`.	`10`
Function named `func` with parameters `x` and `y`	`func(x, y)`
Operator For example, a binary operator `*` with operands `x` and `y`.	`x*y`

Operators

The available operators in order of precedence:

Operator	Description
`()`	A grouping or function call
`!`, `NOT`, `-`	A logical or arithmetic negation
`^`, `%`	Exponentiation, Modulo
`*`, `/`	Multiplication, division
`+`, `-`	Addition, subtraction
`<`, `<=`, `>`, `>=`	Less than, less than or equal to, greater than, greater than or equal to
`==`, `!=`	Match, does not match
`&&`, `AND`	Logical AND
`\|\|`, `OR`	Logical OR

Functions

The available functions are categorized as follows:

Arithmetic
String
Logical

Arithmetic

abs(num value)

Returns the absolute value of a number.

Example

Example	Formula	Result
A log event has the following attributes: - `@client_latency` = 2 - `@server_latency` = 3	`#discrepancy = abs(@client_latency - @server_latency)`	`#discrepancy` = 1

ceil(num value)

Rounds number up to the nearest integer.

Example

Example	Formula	Result
A log event has the following attribute: `@value` = 2.2	`#rounded_up = ceil(@value)`	`#rounded_up` = 3

floor(num value)

Rounds number down to the nearest integer.

Example

Example	Formula	Result
A log event has the following attribute: `@value` = 9.99	`#rounded_down = floor(@value)`	`#rounded_down` = 9

max(num value, [ num value, …])

Finds maximum value amongst a set of numbers.

Example

Example	Formula	Result
A log event has the following attribute: `@CPU_temperatures` = [-1, 1, 5, 5]	`#highest_temp = max(@CPU_temperatures)`	`#highest_temp` = 5

min(num value, [num value, …])

Finds the minimum value amongst a set of numbers.

Example

Example	Formula	Result
A log event has the following attribute: `@CPU_temperatures` = [-1, 1, 5, 5]	`#lowest_temp = min(@CPU_temperatures)`	`#lowest_temp` = -1

round(num value, int precision)

Rounds a number. Optionally, define how many decimal places to maintain.

Example

Example	Formula	Result
A log event has the following attribute: `@value` = -1234.01	`#rounded_to_tens = round(@value, -1)`	`#rounded_to_tens` = -1230

String

concat(str string [str string, expr value, …])

Combines multiple values into a single string.

Example

Example	Formula	Result
A log event has the following attributes: - `@city` = “Paris” - `@country` = “France”	`#region = concat(@city, ", ", @country)`	`#region` = “Paris, France”

lower(str string)

Converts string to lowercase.

Example

Example	Formula	Result
A log event has the following attribute: `@first_name` = “Bob”	`#lower_name = lower(@first_name)`	`#lower_name` = “bob”

left(str string, int num_chars)

Extracts a portion of text from the beginning of a string.

Example

Example	Formula	Result
A log event has the following attribute: `@price` = “USD10.50”	`#currency = left(@price, 3)`	`#currency` = “USD”

proper(str string)

Converts string to proper case.

Example

Example	Formula	Result
A log event has the following attribute: `@address` = “123 main st”	`#formatted_address = proper(@address)`	`#formatted_address` = “123 Main St”

split_before(str string, str separator, int occurrence)

Extracts the portion of text preceding a certain pattern in a string.

Example

Example	Formula	Result
A log event has the following attribute: `@url` = "www.example.com/path/to/split"	`#url_extraction = split_before(@url, "/", 1)`	`#url_extraction` = "www.example.com/path"
	`#url_extraction = split_before(@url, "/", 2)`	`#url_extraction` = "www.example.com/path/to"

split_after(str string, str separator, int occurrence)

Extracts the portion of text following a certain pattern in a string.

Example

Example	Formula	Result
A log event has the following attribute: `@url` = "www.example.com/path/to/split"	`#url_extraction = split_after(@url, "/", 1)`	`#url_extraction` = "path/to/split"
	`#url_extraction = split_after(@url, "/", 2)`	`#url_extraction` = "to/split"

substring(str string, int start, int length)

Extracts a portion of text from the middle of a string.

Example

Example	Formula	Result
A log event has the following attribute: `@price` = “USD10.50”	`#dollar_value = substring(@price, 2, 2)`	`#dollar_value` = “10”

right(str string, int num_chars)

Extracts a portion of text from the end of a string.

Example

Example	Formula	Result
A log event has the following attribute: `@price` = “USD10.50”	`#cent_value = right(@price, 2)`	`#cent_value` = “50”

textjoin(str delimiter, bool ignore_empty, str string [str string, expr value, …])

Combines multiple values into a single string with a delimiter in between.

Example

Example	Formula	Result
A log event has the following attributes: - `@city` = “Paris” - `@country` = “France”	`#region = textjoin(", ", "false", @city, @country)`	`#region` = “Paris, France”

upper(str string)

Converts string to uppercase.

Example

Example	Formula	Result
A log event has the following attribute: `@first_name` = “Bob”	`#upper_name = upper(@first_name)`	`#upper_name` = “BOB”

Logical

if(expr condition, expr if_true, expr if_false)

Evaluates a condition and returns a value accordingly.

Example

Example	Formula	Result
A log event has the following attributes: - `@location` = “Paris, France” - `@home` = “New York, USA”	`#abroad = if(@location == @home, "false", "true")`	`#abroad` = “true”