All Products
Search
Document Center

Simple Log Service:Overview of expression functions

Last Updated:Aug 08, 2023

This topic describes the expression functions that you can use to transform data in Simple Log Service.

CategoryFunctionDescription
Event check functionse_hasChecks whether a field exists.
e_not_hasChecks whether a field does not exist.
e_searchSearches for a log by using simplified, Lucene-like query syntax.
e_match, e_match_all, and e_match_anyChecks whether the value of a field in a log matches a specified expression.
Operator functionsop_ifReturns the value of an expression based on a specified condition.
op_ifnullReturns the value of the first expression whose value is not None.
op_coalesceReturns the value of the first expression whose value is not None.
op_nullifReturns the value None if the value of Expression 1 is equal to the value of Expression 2. If the values of Expression 1 and Expression 2 are different, the value of Expression 1 is returned.
op_andReturns a Boolean result after two or more specified fields are evaluated by using the logical AND operator. Each field can be of an arbitrary data type.
op_notReturns a reverse Boolean result after two or more specified fields are evaluated by using the logical NOT operator. Each field can be of an arbitrary data type.
op_orReturns a Boolean result after two or more specified fields are evaluated by using the logical OR operator. Each field can be of an arbitrary data type. If one or more of the specified fields are evaluated to true, the value True is returned. Otherwise, the value False is returned.
op_eqReturns True or False based on the a==b condition.
op_geReturns True or False based on the a>=b condition.
op_gtReturns True or False based on the a>b condition.
op_leReturns True or False based on the a<=b condition.
op_ltReturns True or False based on the a<b condition.
op_neReturns True or False based on the a!=b condition.
op_lenCalculates the number of characters in a text string. This function applies to strings or expressions that return tuples, lists, or dictionaries.
op_inChecks whether a string, tuple, list, or dictionary contains a specified element. This function returns True or False.
op_not_inChecks whether a string, tuple, list, or dictionary does not contain a specified element. This function returns True or False.
op_sliceExtracts strings from a specified string, array, or tuple.
op_indexReturns the element that corresponds to the index of a specified string, array, or tuple.
op_addCalculates the sum of multiple values. The values can be strings or numbers.
op_maxReturns the largest value among the values of multiple fields or expressions.
op_minReturns the smallest value among the values of multiple fields or expressions.
Conversion functionsct_intConverts the value of a field or an expression to an integer.
ct_floatConverts the value of a field or an expression to a floating-point number.
ct_strConverts the value of a field or an expression to a string.
ct_boolConverts the value of a field or an expression to a Boolean value.
ct_chrConverts the ANSI or Unicode value of a field or an expression to a character.
ct_ordConverts the value of a field or an expression to an ANSI value or a Unicode value.
ct_hexConverts the value of a field or an expression to a hexadecimal number.
ct_octConverts the value of a field or an expression to an octal number.
ct_binConverts the value of a field or an expression to a binary number.
bin2octConverts a binary byte string to an octal string.
bin2hexConverts a binary byte string to a hexadecimal string.
Arithmetic functionsop_absReturns the absolute value of an input value.
op_div_floorReturns the integer part of the quotient of two input values.
op_div_trueReturns the quotient of two input values.
op_powRaises an input value to a specified power.
op_mulReturns the product of two input values.
op_negReturns the opposite number of an input value.
op_modReturns the remainder of an input value divided by the other input value.
op_subReturns the difference between two input values.
op_roundRounds an input value.
op_sumReturns the sum of input values.
mat_ceilRounds an input value up to the nearest integer.
mat_expRaises e to a specified power.
mat_fabsReturns the absolute value of an input value.
mat_floorRounds an input value down to the nearest integer.
mat_logReturns the logarithm of an input value with the other input value as the base.
mat_log10Returns the base-10 logarithm of an input value.
mat_sqrtReturns the square root of an input value.
mat_degreesConverts radians to degrees.
mat_radiansConverts degrees to radians.
mat_sinReturns the sine of an input value in radians.
mat_cosReturns the cosine of an input value in radians.
mat_tanReturns the tangent of an input value in radians.
mat_acosReturns the arc cosine of an input value in radians.
mat_asinReturns the arc sine of an input value in radians.
mat_atanReturns the arc tangent of an input value in radians.
mat_atan2Returns the arc tangent of X and Y coordinates.
mat_atanhReturns the inverse hyperbolic tangent of an input value.
mat_hypotReturns the Euclidean norm of two input values.
String functionsstr_formatFormats strings in a specified format.
str_joinConcatenates input strings by using a specified connector to generate a new string.
str_zipConcurrently splits two values or strings that are returned by expressions and combines the results into one string.
str_encodeEncodes a string by using a specified encoding format.
str_decodeDecodes an input value by using a specified encoding format.
str_hex_escape_encodeEscapes special characters. The function can escape hexadecimal characters to Chinese characters.
str_sortSorts a specified object.
str_reverseReverses a string.
str_replaceReplaces an existing string with a specified string based on a specified rule.
str_logtash_config_normalizeConverts the data in the Logstash configuration language to the JSON format.
str_translateReplaces specified characters in a string with mapping characters.
str_stripDeletes specified characters from a string.
str_lstripDeletes specified characters from the start of a string.
str_rstripDeletes specified characters from the end of a string.
str_lowerConverts all uppercase letters in a string to lowercase letters.
str_upperConverts all lowercase letters in a string to uppercase letters.
str_titleCapitalizes the first letter of each word in a string and converts the other letters in the string to lowercase letters.
str_capitalizeCapitalizes the first letter of a string and converts the other letters in the string to lowercase letters.
str_swapcaseConverts the uppercase letters in a string to lowercase letters and lowercase letters to uppercase letters.
str_countCounts the number of occurrences of a character in a string.
str_findChecks whether a string contains a specified substring.
str_rfindReturns the position of the last occurrence of a specified character in a string.
str_endswithChecks whether a string ends with a specified suffix.
str_startswithChecks whether a string starts with a specified string.
str_splitSplits a string by using a specified delimiter.
str_splitlinesSplits a string by using a line feed.
str_partitionSplits a string into three parts from left to right by using a specified delimiter.
str_rpartitionSplits a string into three parts from right to left by using a specified delimiter.
str_centerPads a string to a specified length by using a specified character.
str_ljustRight pads a string to a specified length by using a specified character.
str_rjustLeft pads a string to a specified length by using a specified character.
str_zfillLeft pads a string to a specified length by using 0.
str_expandtabsConverts \t in a string to spaces.
str_isalnumChecks whether a string contains only letters and digits.
str_isalphaChecks whether a string contains only letters.
str_isasciiChecks whether a string is in the ASCII table.
str_isdecimalChecks whether a string contains only decimal characters.
str_isdigitChecks whether a string contains only digits.
str_isidentifierChecks whether a string is a valid Python identifier or checks whether a variable name is valid.
str_islowerChecks whether a string contains lowercase letters.
str_isnumericChecks whether a string contains digits.
str_isprintableChecks whether all characters in a string are printable characters.
str_isspaceChecks whether a string contains only spaces.
str_istitleChecks whether the first letter of each word in a string is in uppercase and the other letters in the string are in lowercase.
str_isupperChecks whether all letters in a string are in uppercase.
str_uuidGenerates a random universally unique identifier (UUID).
Date and time functionsdt_parseConverts a value or the value of a time expression to a datetime object.
dt_strConverts a value or the value of a time expression to a string.
dt_parsetimestampConverts a value or the value of a time expression to a UNIX timestamp.
dt_propObtains a specific attribute from the value of a time expression, such as the day or year.
dt_nowObtains the current date and time.
dt_todayObtains only the current date.
dt_utcnowObtains the current date and time from the current time zone.
dt_fromtimestampConverts a UNIX timestamp to a datetime object.
dt_utcfromtimestampConverts a UNIX timestamp to a datetime object in the current time zone.
dt_strptimeParses a time string into a datetime object.
dt_currentstampObtains the current UNIX timestamp.
dt_totimestampConverts a datetime object to a UNIX timestamp.
dt_strftimeConverts a datetime object to a string in a specified format.
dt_strftimestampConverts a UNIX timestamp to a string in a specified format.
dt_truncateExtracts a time value from a value or the value of a time expression based on a specified time granularity.
dt_addChanges a value or the value of a time expression based on a specified time granularity.
dt_MOOffsets a specified time to the date of the previous or following Nth Monday. The offset value N is passed to the weekday parameter of the dt_add function.
dt_TUOffsets a specified time to the date of the previous or following Nth Tuesday. The offset value N is passed to the weekday parameter of the dt_add function.
dt_WEOffsets a specified time to the date of the previous or following Nth Wednesday. The offset value N is passed to the weekday parameter of the dt_add function.
dt_THOffsets a specified time to the date of the previous or following Nth Thursday. The offset value N is passed to the weekday parameter of the dt_add function.
dt_FROffsets a specified time to the date of the previous or following Nth Friday. The offset value N is passed to the weekday parameter of the dt_add function.
dt_SAOffsets a specified time to the date of the previous or following Nth Saturday. The offset value N is passed to the weekday parameter of the dt_add function.
dt_SUOffsets a specified time to the date of the previous or following Nth Sunday. The offset value N is passed to the weekday parameter of the dt_add function.
dt_astimezoneConverts a value or the value of a time expression to a datetime object in a specified time zone.
dt_diffReturns the difference between two values or between the values of two time expressions based on a specified time granularity.
Regular expression functionsregex_selectExtracts a value that matches a regular expression.
regex_findallExtracts all values that match a regular expression.
regex_matchChecks whether a value matches a regular expression.
regex_replaceReplaces the characters that match a regular expression in a string.
regex_splitSplits a string into an array of strings.
Grok functiongrokExtracts a value that matches a regular expression.
Structured data functionsjson_selectExtracts or calculates a specified value from a JSON expression based on the JMESPath syntax.
json_parseParses a specified value into a JSON object.
xml_to_jsonConverts XML data to JSON data, and then expands the converted data.
IP address parsing functionsgeo_parseParses an IP address into the information about the city, province, and country of the IP address.
ip_cidrmatchChecks whether an IP address belongs to a CIDR block.
ip_versionChecks whether the version of an IP address is IPv4 or IPv6.
ip_typeIdentifies the type of an IP address and checks whether the type of the IP address is private or public.
ip_makenetConverts an IP address to a CIDR block.
ip_to_formatConverts the format of a CIDR block to a format that specifies the netmask or prefix length of the CIDR block.
ip_overlapsChecks whether two CIDR blocks overlap.
ip2longConverts an IP address to a value of the long type.
long2ipConverts a value of the long type to an IP address.
Encoding and decoding functionsurl_encodingPerforms URL encoding on data.
url_decodingPerforms URL decoding on data.
protobuf_decodingParses data into the JSON format by using a specified Protobuf template.
str_encodeEncodes a string by using a specified encoding format.
str_decodeDecodes an input value by using a specified encoding format.
base64_encodingEncodes data by using the Base64 algorithm.
base64_decodingDecodes data by using the Base64 algorithm.
html_encodingEncodes data in the HTML format.
html_decodingDecodes HTML-encoded data.
md5_encodingEncodes data by using the MD5 algorithm.
sha1_encodingEncodes data by using the SHA1 algorithm.
crc32_encodingCalculates a cyclic redundancy check (CRC) code for data.
gzip_compressCompresses and encodes data.
gzip_decompressDecompresses compressed data.
zlib_compressCompresses and encodes data.
zlib_decompressDecompresses compressed data.
aes_encryptEncrypts data by using the AES algorithm.
aes_decryptDecrypts data by using the AES algorithm.
jwt_encodingEncodes JSON data based on the JSON Web Token (JWT) standard.
jwt_decodingDecodes data to raw JSON data based on the JWT standard.
hashids_encodingEncodes data by using the Hashids library.
hashids_decodingDecodes data that is encoded by using the Hashids library.
Parsing functionsua_parse_deviceParses User-Agent and returns the device information.
ua_parse_osParses User-Agent and returns the operating system information.
ua_parse_agentParses User-Agent and returns the browser information.
ua_parse_allParses User-Agent and returns all information.
url_parseParses a URL and returns the components of the URL.
url_parse_qsParses the query string of a URL and returns the components of the query string.
List functionslst_makeConstructs a list.
lst_insertInserts elements to a specified position in a list.
lst_appendAppends elements to a list.
lst_delete_atDeletes the element at a specified position from a list.
lst_reverseReverses the order of elements in a list.
lst_getObtains an element from a list or tuple.
Dictionary functionsdct_makeConstructs a dictionary.
dct_updateUpdates a dictionary.
dct_deleteDeletes key-value pairs from a dictionary.
dct_keysObtains the keys of a dictionary.
dct_valuesObtains the values of a dictionary.
dct_getObtains the value that corresponds to a specified key in a dictionary.
Table functionstab_parse_csvConstructs a table from comma-separated values (CSV) text.
tab_to_dictConstructs a dictionary from a table.
Resource functionsres_localPulls the values of advanced parameters from the current data transformation task.
res_rds_mysqlPulls data from a specified table in a database that is created on an ApsaraDB RDS for MySQL instance or obtains the execution result of an SQL statement. The data can be updated at regular intervals.
res_log_logstore_pullPulls data from another Logstore when you transform data in a Logstore. You can continuously pull data.
res_oss_filePulls data from an object in a specified Object Storage Service (OSS) bucket. The data can be updated at regular intervals.