Basic syntax

Comments

# Set the default topic. This is a comment placed at the beginning of a step.
e_set("__topic__", "access_log")   # Set the default topic. This is a comment placed at the end of a step.

Line wrapping

e_set("__topic__", "v1",
        "type", "v2",       # Break the parameter list with a comma (,).
        "length", 100)
e_set("__topic__", "this is a very long long long .........." \
                            "......long text")

Function invoking

• Invoke the basic functions
  For example:

  e_set("abc", "xyz")

  Note The number of parameter values that you pass to the function must be the same as the number of parameters defined for the function.
• Pass the basic variable parameters
  For example:

  str_replace(value, old [,new [,count] ]) 

  Note The parameters in the square brackets are optional, for example, the new and count parameters in the preceding function. You cannot pass these parameters in the same way as the named parameters.

  # The following functions are invalid.
  str_replace("a-b-c", "-", new='%')
  str_replace("a-b-c", "-", new='%', count=1)

  You must pass these parameters in sequence.

  str_replace("a-b-c", "-", '%')
  str_replace("a-b-c", "-", '%', 2)

• Pass the named parameters
  A parameter with a default value is called a named parameter. For example, the mode parameter in the e_set("abc", "xyz", mode="fill") function is a named parameter.

  • You must pass the values for the named parameters in some functions under specific conditions. For more information, see the parameter description of each function.
  • You can pass the value of a named parameter by setting a parameter in the format of mode=....
  • Multiple named parameters can be passed in random order. For example, e_csv("data", ["f1", "f2", "f3"], sep='#', quote="|") is equivalent to e_csv("data", ["f1", "f2", "f3"], quote="|", sep='#').

  Note The named parameters always come after the non-named parameters.
• Invoke a combination of functions
  You can pass the returned value of a function as the value of a parameter to another function. In this case, you must make sure that the returned value is of the same data type as the value of the parameter. Examples:

  e_set("abc", v("xyz"))
  e_set("abc", str_lower(v("xyz")))

• Variable parameters

  You can pass variable parameters to some functions. The v("f1", ....) function indicates that multiple parameters can be passed, for example, v("f1", "f2", "f3").

  If you need to pass both variable parameters and named parameters, you must place the named parameters after the variable parameters, for example, v("f1", "f2", "f3", "f4", mode="fill").

Operator

# * 
e_set("a", 3600 * 6)    # Invalid
e_set("a", op_mul(3600, 6))    # Valid

# /
e_set("bytes_kb", v("bytes") / 1024)    # Invalid
e_set("bytes_kb", op_div_floor(v("bytes"), 1024))    # Valid

True or false evaluation

Some functions determine the event processing logic by checking whether a condition is true or false. A condition can be a fixed value or a value returned by an expression function.

e_if(True, DROP)      # Discard log entries if the value of the first parameter is true.
e_if(1, DROP)       # Discard log entries if the value of the first parameter is 1.
e_if(v("abc"), DROP)      # Discard log entries if the abc field exists and is not empty.
e_if(str_isdigit(v("abc")), DROP) # Discard log entries if the abc field exists and contains only digits.