This topic describes how to enrich log data by using the mapping function e_dict_map.
Common mapping functions
Common mapping functions map data by using the full-text matching method. If richer field matching methods are needed, such as regex matching, exact matching, or fuzzy matching, use the search mapping functions. Common mapping functions include the e_dict_map and e_table_map functions. The input data of the e_dict_map function is in the dictionary format. The input data of the e_table_map function is in the format of a table obtained by using resource functions.
For example, you can use the e_dict_map function to transform HTTP status codes in nginx logs into data of the Text type.
HTTP status code | Text |
200 | Success |
300 | Redirect |
400 | Request error |
500 | Server error |
e_dict_map
This section describes how to use the e_dict_map function to enrich log data.
Raw log entry
http_host: example.com http_status: 300 request_method: GET http_host: example.org http_status: 200 request_method: POST http_host: example.net http_status: 400 request_method: GET http_host: aliyundoc.com http_status: 500 request_method: GETTransformation requirements
Transform the status codes in the http_status field into data of the Text type and add the transformed data to the status_desc field.
Transformation rule
e_dict_map({"400": "Request error", "500": "Server error", "300": "Redirect", "200": "Success"}, "status", "status_desc")NoteThe preceding transformation rule includes only four HTTP status codes. For more information, see HTTP status codes. If the value of the http_status field is 401 or 404, the corresponding value must be included in the source dictionary. Otherwise, the data mapping will fail.
Result
http_host: example.com http_status: 300 request_method: GET status_desc: Redirect http_host: example.org http_status: 200 request_method: POST status_desc: Success http_host: example.net http_status: 400 request_method: GET status_desc: Request error http_host: aliyundoc.com http_status: 500 request_method: GET status_desc: Server error