This topic describes the syntax of table functions and provides parameter description and function examples.

Functions

Type Function Description
Text-to-table conversion tab_parse_csv Constructs a table from a delimited text file.
Table-to-dictionary conversion tab_to_dict Constructs a dictionary from a table.

tab_parse_csv

  • Syntax 
    tab_parse_csv(data, sep=',', quote='"', lstrip=True, headers=None, case_insensitive=True)
  • Parameters
    Parameter Type Required? Description
    data String Yes The text data in a delimited format. Generally, the data is in comma-separated values (CSV) format.
    sep String No The delimiter used to separate values. Default value: comma (,).
    quote String No The character used to enclose a value when the value contains the delimiter. Default value: double quotation mark (").
    lstrip Boolean No Specifies whether to trim the leading space characters from each value. Default value: True.
    headers String or string list No The column headers used to parse data. By default, the system retrieves the headers from the first row of the data. If the first row of the data is not used to store headers, you can pass the headers to the function through this parameter. This parameter can be set to a string or a string list.
    case_insensitive Boolean No Specifies whether field names are matched in a case-insensitive manner. Default value: True.
  • Response

    The constructed table is returned.

  • Examples
    • Example 1: Construct a table and map a field in the raw log to the table data. The source Logstore must contain fields in the table so that the mapping between the log data and the table data can be established.
      Raw log: 
      city:  nanjing
      Processing rule: 
      e_table_map(tab_parse_csv("province,city,pop,gdp\nshanghai,shanghai,2000,1000\njiangsu,nanjing,800,500"), "city", "province")
      Processing result: 
      city:  nanjing
province:  jiangsu
    • Example 2: Construct a table and map multiple fields in the raw log to the table data.
      Raw log: 
      city:  nanjing
province:  jiangsu
      Processing rule: 
      e_table_map(tab_parse_csv("province,city,pop,gdp\nshanghai,shanghai,2000,1000\njiangsu,nanjing,800,500"), ["province", "city"], ["pop", "gdp"])
      Processing result: 
      city:  nanjing
gdp:  500
pop:  800
province:  jiangsu
    • Example 3: Construct a table and map multiple fields in the raw log to the table data. In this example, a field in the raw log is not the same as that in the table. In the parentheses for specifying the source field, the first field is the field from the raw log and the second field is the field from the table. In the parentheses for specifying the target field, the first field is the field from the table, and the second field is a new field.
      Raw log: 
      city:  nanjing
province:  jiangsu
      Processing rule: 
      e_table_map(tab_parse_csv("prov,city,pop,gdp\nshanghai,shanghai,2000,1000\njiangsu,nanjing,800,500"), [("province","prov"), "city"], [("pop", "population"), ("gdp", "GDP")])
      Processing result: 
      GDP:  500
city:  nanjing
population:  800
province:  jiangsu

tab_to_dict

  • Syntax 
    tab_to_dict(table, key_field, value_field, key_join=",", value_join=",")
  • Parameters
    Parameter Type Required? Description
    table Table Yes The table data from which the dictionary is constructed.
    key_field String or string list Yes The columns used to construct keys in the dictionary. Separate multiple columns with the character specified by key_join.
    value_field String or string list Yes The columns used to construct values in the dictionary. Separate multiple columns with the character specified by value_join.
    key_join String No The string used to separate multiple columns that are used as keys in the dictionary. Default value: comma (,).
    value_join String No The string used to separate multiple columns that are used as values in the dictionary. Default value: comma (,).
  • Response

    The constructed dictionary is returned.

  • Examples
    • Example 1
      Raw log: 
      k1: v1
city: nj
      Processing rule: 
      e_dict_map(tab_to_dict(tab_parse_csv("city,pop\nsh,2000\nnj,800"), "city", "pop"), "city", "popu")
      Processing result: 
      k1: v1
city: nj
popu: 800
    • Example 2
      Raw log: 
      k1: v1
city: js,nj
      Processing rule: 
      e_dict_map(tab_to_dict(tab_parse_csv("province,city,pop\nsh,sh,2000\njs,nj,800"), ["province", "city"], "pop"), "city", "popu")
      Processing result: 
      k1: v1
city: js,nj
popu: 800