This topic describes the syntax and parameters of flow control functions. This topic also provides examples on how to use the functions.

Functions

Function Description
e_compose Combines multiple operations.
  • The function is commonly used in the e_if, e_switch, or e_if_else function.
  • The function performs specified operations on a log in sequence and returns the result.
  • If the function performs an operation that deletes a log, the function no longer performs other operations on the log.

This function can be used in combination with other functions. For more information, see Transform complex JSON data.

e_if Performs an operation if a specified condition is met. You can specify multiple condition-operation pairs.
  • If a condition is met, the function performs the operation that corresponds to the condition. If the condition is not met, the function does not perform the operation, but evaluates the next condition.
  • If the function performs an operation that deletes a log, the function no longer performs other operations on the log.
e_if(
    e_has("a"), e_output("target-a"), 
    e_has("b"), e_output("target-b"),
)
The preceding example of the function is equivalent to the following Python code:
if e_has("a"):
    e_output("target-a")
if e_has("b"):
    e_output("target-b")

This function can be used in combination with other functions. For more information, see Transform complex JSON data.

e_if_else Performs an operation based on the evaluation result of a specified condition.
e_if_else(e_has("a"), e_output("target-a"), e_output("target-b"))
The preceding example of the function is equivalent to the following Python code:
if e_has("a"):
    e_output("target-a")
else:
    e_output("target-b")
e_switch Performs an operation if a specified condition is met. You can specify multiple condition-operation pairs.
  • If a condition is met, the function performs the operation that corresponds to the condition and returns the result. If the condition is not met, the function does not perform the operation, but evaluates the next condition.
  • If no specified conditions are met and the default parameter is configured, the function performs the operation that is specified by the default parameter and returns the result.
  • If the function performs an operation that deletes a log, the function no longer performs other operations on the log.
e_switch(
    e_has("a"), e_output("target-a"), 
    e_has("b"), e_output("target-b"),
    default=e_output("target-default"), 
)
The preceding example of the function is equivalent to the following Python code:
if e_has("a"):
    e_output("target-a")
elif e_has("b"):
    e_output("target-b")
else:
    e_output("target-default")

This function can be used in combination with other functions. For more information, see Distribute data to multiple destination Logstores.

e_compose

The e_compose function combines multiple operations.
  • Syntax

    e_compose(operation_1, operation_2, ...)     
  • Parameters

    Parameter Type Required Description
    operation_1 Global processing function Yes A global processing function or a combination of global processing functions.
    operation_2 Global processing function No A global processing function or a combination of global processing functions.
  • Response

    A log on which the specified operations are performed is returned.

  • Examples

    If the value of the content field is 123, delete the age and name fields and then change the value of the content field to ctx.

    • Raw log:
      content: 123
      age: 23
      name: twiss
    • Transformation rule:
      e_if(
          e_search("content==123"),
          e_compose(e_drop_fields("age|name"), e_rename("content", "ctx")),
      )
    • Result:
      ctx: 123
  • References

    This function can be used in combination with other functions. For more information, see Transform complex JSON data.

e_if

The e_if function performs an operation if a specified condition is met.
  • Syntax

    e_if(condition, operation)
    e_if(condition_1, operation_1, condition_2, operation_2, ...)
    Note You must specify the condition and operation parameters in pairs.
  • Parameters

    Parameter Type Required Description
    condition Arbitrary Yes An expression or a combination of expressions. If the result is not a Boolean value, the system evaluates whether the condition is true or false.
    operation Global processing function No A global processing function or a combination of global processing functions.
  • Response

    A log on which the specified operations are performed is returned.

  • Examples

    • Example 1: Match a field value against specified values and perform an operation.
      If the value of the result field is failed or failure, set the __topic__ field to login_failed_event.
      e_if(e_match("result", r"failed|failure"), e_set("__topic__", "login_failed_event"))
    • Example 2: Perform evaluation based on a field value and perform an operation.
      If the request_body field exists and the field is not empty, call the field processing function e_json to expand the value of the request_body field into multiple values.
      e_if(v("request_body"), e_json("request_body"))
    • Example 3: Perform advanced evaluation and perform an operation.
      If the value of the valid field is failed in lowercase, discard the log.
      e_if(op_eq(str_lower(v("valid")), "failed"), DROP)
    • Example 4: Perform multiple operations in sequence based on specified conditions.
      e_if(True, e_set("__topic__", "default_login"), 
           e_match("valid", "failed"), e_set("__topic__", "login_failed_event")
        )
  • References

    This function can be used in combination with other functions. For more information, see Transform complex JSON data.

e_if_else

The e_if_else function performs an operation based on the evaluation result of a specified condition.
  • Syntax

    e_if_else(condition, operation_1 if the condition evaluates to true, operation_2 if the condition evaluates to false)
  • Parameters

    Parameter Type Required Description
    condition Arbitrary Yes An expression or a combination of expressions. If the result is not a Boolean value, the system evaluates whether the condition is true or false.
    operation_1 if the condition evaluates to true Global processing function Yes A global processing function or a combination of global processing functions.
    operation_2 if the condition evaluates to false Global processing function Yes A global processing function or a combination of global processing functions.
  • Response

    A log on which an operation is performed based on the evaluation result of the specified condition is returned.

  • Examples

    If the value of the result field is ok or pass or if the value of the status field is 200, retain the log.

    • Raw logs:
      result: ok
      status: 400
      result: Pass
      status: 200
      result: failure
      status: 500
    • Transformation rule:
      e_if_else(
          op_or(e_match("result", r"(?i)ok|pass"), e_search("status== 200")), KEEP, DROP
      )
    • Result: The first two logs are retained. The third log is discarded.
      result: ok
      status: 400
      result: Pass
      status: 200

e_switch

The e_switch function performs an operation if a specified condition is met.
  • Syntax

    e_switch(condition_1, operation_1, ..., default=None)
    Note You must specify the condition and operation parameters in pairs.
  • Parameters

    Parameter Type Required Description
    condition Arbitrary Yes An expression or a combination of expressions. If the result is not a Boolean value, the system evaluates whether the condition is true or false.
    operation Global processing function Yes A global processing function or a combination of global processing functions.
    default Global processing function No A global processing function or a combination of global processing functions. If no specified conditions are met, the operation specified by the default parameter is performed.
  • Response

    A log on which the specified operations are performed is returned.

  • Examples

    • If the value of the content field is 123, set the __topic__ field to Number. If the value of the data field is 123, set the __topic__ field to PRO.
      • Raw log:
        __topic__:  
        age: 18
        content: 123
        name: maki
        data: 342
        __topic__:  
        age: 18
        content: 23
        name: maki
        data: 123
      • Transformation rule:
        e_switch(
            e_search("content==123"),
            e_set("__topic__", "Number", mode="overwrite"),
            e_search("data==123"),
            e_set("__topic__", "PRO", mode="overwrite"),
        )
      • Result:
        __topic__: Number
        age: 18
        content: 123
        name: maki
        data: 342
        __topic__: PRO
        age: 18
        content: 23
        name: maki
        data: 123
    • You can combine the e_switch and e_output functions to ship the logs that meet specified conditions to different Logstores. If you specify default=e_drop(), the logs that do not meet specified conditions are discarded and not shipped. If you do not configure the default parameter, the logs that do not meet specified conditions are shipped to the first Logstore that you specify.
      • Raw log:
        __topic__: sas-log-dns
        test: aliyun
        
        __topic__: aegis-log-network
        test:ecs
        
        __topic__: local-dns
        test:sls
        
        __topic__: aegis-log-login
        test: sls
      • Transformation rule:
        e_switch(e_match("__topic__","sas-log-dns"),e_output(name="target1"),
        e_match("__topic__","sas-log-process"),e_output(name="target2"),
        e_match("__topic__","local-dns"),e_output(name="target3"),
        e_match("__topic__","aegis-log-network"),e_output(name="target4"),
        e_match("__topic__","aegis-log-login"),e_output(name="target5"),
        default=e_drop())
  • References

    This function can be used in combination with other functions. For more information, see Distribute data to multiple destination Logstores.