This topic describes the syntax and parameters of flow control functions. This topic also provides examples on how to use the functions.
Functions
Function | Description |
Combines multiple operations.
This function can be used in combination with other functions. For more information, see Transform complex JSON data. | |
Performs an operation if a specified condition is met. You can specify multiple condition-operation pairs.
The preceding example of the function is equivalent to the following Python code:
This function can be used in combination with other functions. For more information, see Transform complex JSON data. | |
Performs an operation based on the evaluation result of a specified condition.
The preceding example of the function is equivalent to the following Python code:
| |
Performs an operation if a specified condition is met. You can specify multiple condition-operation pairs.
The preceding example of the function is equivalent to the following Python code:
This function can be used in combination with other functions. For more information, see Distribute data to multiple destination Logstores. |
e_compose
The e_compose function combines multiple operations.
Syntax
e_compose(Operation 1, Operation 2, ...)
Parameters
Parameter
Type
Required
Description
Operation 1
Global processing function
Yes
A global processing function or a combination of global processing functions.
Operation 2
Global processing function
No
A global processing function or a combination of global processing functions.
Response
A log on which the specified operations are performed is returned.
Examples
If the value of the content field is 123, delete the age and name fields and then change the value of the content field to ctx.
Raw log
content: 123 age: 23 name: twiss
Transformation rule
e_if( e_search("content==123"), e_compose(e_drop_fields("age|name"), e_rename("content", "ctx")), )
Result
ctx: 123
References
This function can be used in combination with other functions. For more information, see Transform complex JSON data.
e_if
The e_if function performs an operation if a specified condition is met.
Syntax
e_if(Condition, Operation) e_if(Condition 1, Operation 1, Condition 2, Operation 2, ...)
NoteYou must specify the
Condition
andOperation
parameters in pairs.Parameters
Parameter
Type
Required
Description
Condition
Arbitrary
Yes
An expression or a combination of expressions. If the result is not a Boolean value, the system evaluates whether the condition is true or false.
Operation
Global processing function
Yes
A global processing function or a combination of global processing functions.
Response
A log on which the specified operations are performed is returned.
Examples
Example 1: Match a field value against specified values and perform an operation.
If the value of the result field is failed or failure, set the __topic__ field to
login_failed_event
.e_if(e_match("result", r"failed|failure"), e_set("__topic__", "login_failed_event"))
Example 2: Perform evaluation based on a field value and perform an operation.
If the request_body field exists and the field is not empty, call the field processing function e_json to expand the value of the request_body field into multiple values.
e_if(v("request_body"), e_json("request_body"))
Example 3: Perform advanced evaluation and perform an operation.
If the value of the valid field is failed in lowercase, discard the log.
e_if(op_eq(str_lower(v("valid")), "failed"), DROP)
Example 4: Perform multiple operations in sequence based on specified conditions.
e_if(True, e_set("__topic__", "default_login"), e_match("valid", "failed"), e_set("__topic__", "login_failed_event") )
References
This function can be used in combination with other functions. For more information, see Transform complex JSON data.
e_if_else
The e_if_else function performs an operation based on the evaluation result of a specified condition.
Syntax
e_if_else(Condition, Operation 1 if Condition evaluates to true, Operation 2 if Condition evaluates to false)
Parameters
Parameter
Type
Required
Description
Condition
Arbitrary
Yes
An expression or a combination of expressions. If the result is not a Boolean value, the system evaluates whether the condition is true or false.
Operation 1 if Condition evaluates to true
Global processing function
Yes
A global processing function or a combination of global processing functions.
Operation 2 if Condition evaluates to false
Global processing function
Yes
A global processing function or a combination of global processing functions.
Response
A log on which an operation is performed based on the evaluation result of the specified condition is returned.
Examples
If the value of the result field is ok or pass or if the value of the status field is 200, retain the log.
Raw log
result: ok status: 400
result: Pass status: 200
result: failure status: 500
Transformation rule
e_if_else( op_or(e_match("result", r"(?i)ok|pass"), e_search("status== 200")), KEEP, DROP )
Result: The first two logs are retained. The third log is discarded.
result: ok status: 400
result: Pass status: 200
e_switch
The e_switch function performs an operation if a specified condition is met.
Syntax
e_switch(Condition 1, Operation 1, ..., default=None)
NoteYou must specify the
Condition
andOperation
parameters in pairs.Parameters
Parameter
Type
Required
Description
Condition
Arbitrary
Yes
An expression or a combination of expressions. If the result is not a Boolean value, the system evaluates whether the condition is true or false.
Operation
Global processing function
Yes
A global processing function or a combination of global processing functions.
default
Global processing function
No
A global processing function or a combination of global processing functions. If no specified conditions are met, the operation specified by the default parameter is performed.
Response
A log on which the specified operations are performed is returned.
Examples
If the value of the content field is 123, set the __topic__ field to Number. If the value of the data field is 123, set the __topic__ field to PRO.
Raw log
__topic__: age: 18 content: 123 name: maki data: 342
__topic__: age: 18 content: 23 name: maki data: 123
Transformation rule
e_switch( e_search("content==123"), e_set("__topic__", "Number", mode="overwrite"), e_search("data==123"), e_set("__topic__", "PRO", mode="overwrite"), )
Result
__topic__: Number age: 18 content: 123 name: maki data: 342
__topic__: PRO age: 18 content: 23 name: maki data: 123
You can combine the e_switch and e_output functions to ship the logs that meet specified conditions to different Logstores. If you specify default=e_drop(), the logs that do not meet specified conditions are discarded and not shipped. If you do not configure the default parameter, the logs that do not meet specified conditions are shipped to the first Logstore that you specify.
Raw log
__topic__: sas-log-dns test: aliyun __topic__: aegis-log-network test:ecs __topic__: local-dns test:sls __topic__: aegis-log-login test: sls
Transformation rule
e_switch(e_match("__topic__","sas-log-dns"),e_output(name="target1"), e_match("__topic__","sas-log-process"),e_output(name="target2"), e_match("__topic__","local-dns"),e_output(name="target3"), e_match("__topic__","aegis-log-network"),e_output(name="target4"), e_match("__topic__","aegis-log-login"),e_output(name="target5"), default=e_drop())
References
This function can be used in combination with other functions. For more information, see Distribute data to multiple destination Logstores.