Basic syntax

Comments

# Set the default topic. (This is a comment placed at the beginning of a step.)
e_set("__topic__", "access_log")   # Set the default topic. (This is a comment placed at the end of a step.)

Line wrapping

e_set("__topic__", "v1",
        "type", "v2",       # Break after a comma.
        "length", 100)
e_set("__topic__", "this is a very long long long..." \
                            "...long text")

Function calls

• Basic function call
  Example:

  e_set("abc", "xyz")

  Note The number of parameter values that you pass to the function must be the same as the number of parameters defined for the function.
• Named parameters
  A parameter with a default value is called a named parameter. For example, the mode parameter in the e_set("abc", "xyz", mode="fill") function is a named parameter.

  • The named parameters in some functions must be set under specific conditions. For more information, see the parameter description of each function.
  • Set a named parameter in the following way: mode=....
  • Multiple named parameters can be passed in any order. For example, e_csv("data", ["f1", "f2", "f3"], sep='#', quote="|") is equivalent to e_csv("data", ["f1", "f2", "f3"], quote="|", sep='#').

  Note In a function call, named parameters always come after non-named parameters.
• Function call combination
  You can pass the return value of a function as a parameter to another function. In this case, make sure that the data types of the return value and the parameter are the same. Example:

  e_set("abc", v("xyz"))
  e_set("abc", str_lower(v("xyz")))

• Variable parameters

  Some functions support variable parameters. v("f1", ...) indicates that more parameters can be passed, for example, v("f1", "f2", "f3").

  If you need to pass variable parameters and named parameters at the same time, place named parameters at the end of the parameter list, for example, v("f1", "f2", "f3", "f4", mode="fill").

Operators

# * 
e_set("a", 3600 * 6)    # Wrong
e_set("a", op_mul(3600, 6))    # Correct

# /
e_set("bytes_kb", v("bytes") / 1024)    # Wrong
e_set("bytes_kb", op_div_floor(v("bytes"), 1024))    # Correct

True or false judgment

Some functions determine the event processing logic by checking whether a condition is true or false. A condition can be a fixed value or a value returned by an expression function.

e_if(True, DROP)      # Discard all events.
e_if(1, DROP)       # Discard all events.
e_if(v("abc"), DROP)      # Discard an event if the abc field exists and is not empty.
e_if(str_isdigit(v("abc")), DROP) # Discard an event if the abc field exists and consists of only digits.