syntax rules for flow control functions - Simple Log Service

Functions

Function	Description
e_compose	Combines multiple operations into a sequence. Performs specified operations on a log in sequence and returns the result. If an operation deletes the log, subsequent operations are skipped. Supports combination with other functions. For more information, see Transform complex JSON data.
e_if	Evaluates conditions and executes corresponding operations. Supports multiple condition-operation pairs. If a condition is met, the corresponding operation executes. Otherwise, the next condition is evaluated. If an operation deletes the log, subsequent operations are skipped. `e_if( e_has("a"), e_output("target-a"), e_has("b"), e_output("target-b"), )` This transformation rule is equivalent to the following Python code: `if e_has("a"): e_output("target-a") if e_has("b"): e_output("target-b")` Supports combination with other functions. For more information, see Transform complex JSON data.
e_if_else	Evaluates a condition and executes one of two operations based on the result. `e_if_else(e_has("a"), e_output("target-a"), e_output("target-b"))` This transformation rule is equivalent to the following Python code: `if e_has("a"): e_output("target-a") else: e_output("target-b")`
e_switch	Evaluates multiple condition-operation pairs in sequence, similar to an if-elif-else chain. If a condition is met, the corresponding operation executes and the result is returned. Otherwise, the next condition is evaluated. If no conditions are met and the default parameter is configured, the default operation executes. If an operation deletes the log, subsequent operations are skipped. `e_switch( e_has("a"), e_output("target-a"), e_has("b"), e_output("target-b"), default=e_output("target-default"), )` This transformation rule is equivalent to the following Python code: `if e_has("a"): e_output("target-a") elif e_has("b"): e_output("target-b") else: e_output("target-default")` Supports combination with other functions. For more information, see Distribute data to multiple destination Logstores.

e_compose

Combines multiple operations into a sequential pipeline.

Syntax

e_compose(Operation 1, Operation 2, ...)

Parameters

Parameter Name	Type	Required	Description
Operation 1	Global processing function	Yes	One or more global processing functions.
Operation 2	Global processing function	No	One or more global processing functions.

Response

Returns the log after all operations are performed.

Examples

If the content field value is 123, delete the age and name fields and rename the content field to ctx.

Raw log
```
content: 123
age: 23
name: twiss
```

Transformation rule

e_if(
    e_search("content==123"),
    e_compose(e_drop_fields("age|name"), e_rename("content", "ctx")),
)

Result
```
ctx: 123
```

References

Supports combination with other functions. For more information, see Transform complex JSON data.

e_if

Evaluates conditions and executes corresponding operations.

Syntax

e_if(Condition, Operation)
e_if(Condition 1, Operation 1, Condition 2, Operation 2, ...)

Note

Specify the Condition and Operation parameters in pairs.

Parameters

Parameter Name	Type	Required	Description
Condition	Arbitrary	Yes	An expression or a combination of expressions. Non-Boolean results are evaluated for truthiness.
Operation	Global processing function	Yes	One or more global processing functions.

Response

Returns the log after the operations are performed.
Examples
- Example 1: Match a field value and perform an operation.
  If the result field value is failed or failure, set the __topic__ field to login_failed_event.
```
e_if(e_match("result", r"failed|failure"), e_set("__topic__", "login_failed_event"))
```
- Example 2: Extract data based on a field value.
  If the request_body field exists and is not empty, use the e_json function to expand the request_body field value into multiple fields.
```
e_if(v("request_body"), e_json("request_body"))
```
- Example 3: Perform an advanced evaluation.
  If the valid field value is failed in lowercase, discard the log.
```
e_if(op_eq(str_lower(v("valid")), "failed"), DROP)
```
- Example 4: Evaluate multiple conditions in sequence.
```
e_if(True, e_set("__topic__", "default_login"), 
     e_match("valid", "failed"), e_set("__topic__", "login_failed_event")
  )
```
References

Supports combination with other functions. For more information, see Transform complex JSON data.

e_if_else

Evaluates a condition and executes one of two operations based on the result.

Syntax

e_if_else(Condition, Operation if true, Operation if false)

Parameters

Parameter Name	Type	Required	Description
Condition	Arbitrary	Yes	An expression or a combination of expressions. Non-Boolean results are evaluated for truthiness.
Operation if true	Global processing function	Yes	One or more global processing functions.
Operation if false	Global processing function	Yes	One or more global processing functions.

Response

Returns the operation result that corresponds to the evaluated condition.
Examples

If the result field value is ok or pass, or the status field value is 200, retain the log. Otherwise, discard the log.
- Raw log
```
result: ok
status: 400
```
```
result: Pass
status: 200
```
```
result: failure
status: 500
```
- Transformation rule
```
e_if_else(
    op_or(e_match("result", r"(?i)ok|pass"), e_search("status== 200")), KEEP, DROP
)
```
- Result: The first two logs are retained and the third log is discarded.
```
result: ok
status: 400
```
```
result: Pass
status: 200
```

e_switch

Evaluates multiple condition-operation pairs in sequence, similar to an if-elif-else chain.

Syntax
```
e_switch(Condition 1, Operation 1, ..., default=None)
```
Note
Specify the Condition and Operation parameters in pairs.

Parameters

Parameter Name	Type	Required	Description
Condition	Arbitrary	Yes	An expression or a combination of expressions. Non-Boolean results are evaluated for truthiness.
Operation	Global processing function	Yes	One or more global processing functions.
default	Global processing function	No	One or more global processing functions. Executes when no conditions are met.

Response

Returns the log after the matched operation is performed.

Examples

If the content field value is 123, set the __topic__ field to Number. If the data field value is 123, set the __topic__ field to PRO.

Raw log

__topic__:  
age: 18
content: 123
name: maki
data: 342

__topic__:  
age: 18
content: 23
name: maki
data: 123

Transformation rule

e_switch(
    e_search("content==123"),
    e_set("__topic__", "Number", mode="overwrite"),
    e_search("data==123"),
    e_set("__topic__", "PRO", mode="overwrite"),
)

Result

__topic__: Number
age: 18
content: 123
name: maki
data: 342

__topic__: PRO
age: 18
content: 23
name: maki
data: 123

Combine e_switch with e_output to route logs that match specific rules to different Logstores. Set default=e_drop() to discard logs that match no rules. If the default parameter is not set, unmatched logs are delivered to the first configured Logstore.

Raw log

__topic__: sas-log-dns
test: aliyun

__topic__: aegis-log-network
test:ecs

__topic__: local-dns
test:sls

__topic__: aegis-log-login
test: sls

Transformation rule

e_switch(e_match("__topic__","sas-log-dns"),e_output(name="target1"),
e_match("__topic__","sas-log-process"),e_output(name="target2"),
e_match("__topic__","local-dns"),e_output(name="target3"),
e_match("__topic__","aegis-log-network"),e_output(name="target4"),
e_match("__topic__","aegis-log-login"),e_output(name="target5"),
default=e_drop())

References

Supports combination with other functions. For more information, see Distribute data to multiple destination Logstores.

Functions

e_compose

Syntax

Parameters

Response

Examples

References

e_if

Syntax

Parameters

Response

Examples

References

e_if_else

Syntax

Parameters

Response

Examples

e_switch

Syntax

Parameters

Response

Examples

References