This topic describes how to use the e_dict_map mapping function to enrich data.
Background information
Standard mapping functions use exact text matching to map data. For more advanced matching methods, such as regular expression, exact, or fuzzy matching, use search mapping functions. Standard mapping functions include the e_dict_map and e_table_map functions. The e_dict_map function accepts data in the dict format, while the e_table_map function accepts table data obtained from resource functions.
For example, use the e_dict_map function to convert specific status codes in NGINX logs to text.
Status code | Text |
200 | Success |
300 | Redirect |
400 | Request error |
500 | Server error |
Use the e_dict_map function for data enrichment
This example demonstrates how to use the e_dict_map function for data enrichment.
Raw logs
http_host: example.com http_status: 300 request_method: GET http_host: example.org http_status: 200 request_method: POST http_host: example.net http_status: 400 request_method: GET http_host: aliyundoc.com http_status: 500 request_method: GETTransformation requirements
Convert the request status codes in the http_status field to text and add them to a new field named status_desc.
Transformation rule
e_dict_map({"400": "Request error", "500": "Server error", "300": "Redirect", "200": "Success"}, "http_status", "status_desc")NoteIn practice, more HTTP status codes exist than the four shown in this example. For a complete list, see HTTP status codes. If the http_status field can have other values, such as 401 or 404, you must update the dictionary to include them. Otherwise, a match is not found.
Result
http_host: example.com http_status: 300 request_method: GET status_desc: Redirect http_host: example.org http_status: 200 request_method: POST status_desc: Success http_host: example.net http_status: 400 request_method: GET status_desc: Request error http_host: aliyundoc.com http_status: 500 request_method: GET status_desc: Server error