Log Service provides the domain-specific language (DSL) to construct expression functions that return specific values to help you transform log data.

The following table lists expression functions.
Type Function Description
Event check functions Functions such as v, e_has, e_not_has, e_search, e_match, e_match_any, and e_match_all Returns the values of fields, or checks whether a field or the value of a field meets specified conditions.
Operator functions op_* functions Compares values, performs condition-based or container-based judgment, or performs general multi-value calculation.
Conversion functions ct_* functions Converts data types among numeric values, strings, and Boolean values, or converts numbers between different numeral systems.
Arithmetic functions op_*, math_*, and mat_* functions Performs mathematical calculation or multi-value calculation.
String functions st_* functions Processes strings.
Date and time functions dt_* functions Converts time data among UNIX timestamps, datetime objects, and date and time strings, changes time zones, and returns the difference between two time values.
Regular expression functions regex_* functions Extracts, returns, replaces, or splits values based on regular expressions.
Grok function Grok function Extracts specific values based on regular expressions.
Structured data functions json_*, xml_*, and pb_* functions Extracts or parses fields.
Encoding and decoding functions url_*, html_*, md5_*, sha1_*, and base64_* functions Encodes or decodes data.
Parsing functions ua_* functions Parses the User-Agent HTTP header.
List functions op_* and lst_* functions Constructs, returns, or modifies a list.
Dictionary functions op_* and dct_* functions Constructs, returns, or modifies a dictionary.
Table functions tab_* functions Constructs a table from a text file or constructs a dictionary from a table.
Resource functions res_* functions Obtains the values of the advanced parameters of a data transformation task. Pulls data from an Object Storage Service (OSS) bucket, Logstores, or a table in an ApsaraDB RDS for MySQL database.