The domain-specific language (DSL) for Log Service is provided to construct expression functions that return specific values. This helps you transform log data.

The following table describes the expression functions.
Category Function Description
Event check functions e_has, e_not_has, e_search, e_match, e_match_any, and e_match_all Checks whether a field exists or whether a field or the value of a field meets a specified condition.
Operator functions Some op_* functions Compares values, evaluates values based on a specified condition or container, or performs general-purpose multi-value operations.
Conversion functions ct_* functions Converts data types among numeric values, strings, and Boolean values, or converts numbers between different numeral systems.
Arithmetic functions math_*, mat_*, and some op_* functions Performs mathematical calculation or multi-value calculation.
String functions str_* functions Processes strings.
Date and time functions dt_* functions Converts time values among UNIX timestamps, datetime objects, and datetime strings, changes time zones, and returns the difference between two time values.
Regular expression functions regex_* functions Extracts, retrieves, replaces, or splits values based on regular expressions.
Grok function Grok function Extracts specific values based on regular expressions.
Structured data functions json_*, xml_*, and gzip_* functions Extracts or parses fields.
IP address parsing functions geo_parse and ip_* functions Parses IP addresses.
Encoding and decoding functions url_*, html_*, md5_*, sha1_*, base64_*, ip2long, long2ip, aes_encrypt, and aes_decrypt functions Encodes or decodes data.
Parsing functions ua_* functions Parses a User-Agent header.
List functions Some op_* and lst_* functions Performs operations on a list, including obtaining or modifying a list.
Dictionary functions Some op_* and dct_* functions Performs operations on a dictionary, including obtaining or modifying a dictionary.
Table functions tab_* functions Constructs a table from text or constructs a dictionary from a table.
Resource functions res_* functions Pulls configuration data and data from an Object Storage Service (OSS) bucket, a Logstore, or a table in an ApsaraDB RDS for MySQL database.