syntax rules for flow control functions - Simple Log Service

This topic describes the syntax and parameters of flow control functions. This topic also provides examples on how to use the functions.

Functions

Function	Description
e_compose	Combines multiple operations. The function is commonly used in the e_if, e_switch, or e_if_else function. The function performs specified operations on a log in sequence and returns the result. If the function performs an operation that deletes a log, the function no longer performs other operations on the log. This function can be used in combination with other functions. For more information, see Transform complex JSON data.
e_if	Performs an operation if a specified condition is met. You can specify multiple condition-operation pairs. If a condition is met, the function performs the operation that corresponds to the condition. If the condition is not met, the function does not perform the operation, but evaluates the next condition. If the function performs an operation that deletes a log, the function no longer performs other operations on the log. `e_if( e_has("a"), e_output("target-a"), e_has("b"), e_output("target-b"), )` For example, this transformation rule is equivalent to the following Python code structure: `if e_has("a"): e_output("target-a") if e_has("b"): e_output("target-b")` This function can be used in combination with other functions. For more information, see Transform complex JSON data.
e_if_else	Performs an operation based on the evaluation result of a specified condition. `e_if_else(e_has("a"), e_output("target-a"), e_output("target-b"))` For example, this transformation rule corresponds to the following Python code structure: `if e_has("a"): e_output("target-a") else: e_output("target-b")`
e_switch	A set of conditions and their associated operations. If a condition is met, the function performs the operation that corresponds to the condition and returns the result. If the condition is not met, the function does not perform the operation, but evaluates the next condition. If no specified conditions are met and the default parameter is configured, the function performs the operation that is specified by the default parameter and returns the result. If the function performs an operation that deletes a log, the function no longer performs other operations on the log. `e_switch( e_has("a"), e_output("target-a"), e_has("b"), e_output("target-b"), default=e_output("target-default"), )` For example, this transformation rule is equivalent to the structure of the following Python code: `if e_has("a"): e_output("target-a") elif e_has("b"): e_output("target-b") else: e_output("target-default")` This function can be used in combination with other functions. For more information, see Distribute data to multiple destination Logstores.

e_compose

You can combine multiple operations.

Syntax

e_compose(Operation 1, Operation 2, ...)

Parameters

Parameter Name	Type	Required	Description
Operation 1	Global processing function	Yes	A global processing function or a combination of global processing functions.
Operation 2	Global processing function	No	A global processing function or a combination of global processing functions.

Response

The log is returned after the operation.
Examples

If the value of the content field is 123, delete the age and name fields and then change the value of the content field to ctx.
- Raw log
```
content: 123
age: 23
name: twiss
```
- Transformation rule
```
e_if(
    e_search("content==123"),
    e_compose(e_drop_fields("age|name"), e_rename("content", "ctx")),
)
```
- Result
```
ctx: 123
```
References
This function can be used in combination with other functions. For more information, see Transform complex JSON data.

e_if

The system executes the operation based on the judgment conditions.

Syntax

e_if(Condition, Operation)
e_if(Condition 1, Operation 1, Condition 2, Operation 2, ...)

Note

You must specify the Condition and Operation parameters in pairs.

Parameters

Parameter Name	Type	Required	Description
Condition	Arbitrary	Yes	An expression or a combination of expressions. If the result is not a Boolean value, the system evaluates whether the condition is true or false.
Operation	Global processing function	Yes	A global processing function or a combination of global processing functions.

Response

A log on which the specified operations are performed is returned.
Examples
- Example 1: Match a field value against specified values and perform an operation.
  If the value of the result field is failed or failure, set the __topic__ field to login_failed_event.
```
e_if(e_match("result", r"failed|failure"), e_set("__topic__", "login_failed_event"))
```
- Example 2: Perform evaluation based on a field value and perform an operation.
  If the request_body field exists and the field is not empty, call the field processing function e_json to expand the value of the request_body field into multiple values.
```
e_if(v("request_body"), e_json("request_body"))
```
- Example 3: Perform advanced evaluation and perform an operation.
  If the value of the valid field is failed in lowercase, discard the log.
```
e_if(op_eq(str_lower(v("valid")), "failed"), DROP)
```
- Example 4: Perform multiple operations in sequence based on specified conditions.
```
e_if(True, e_set("__topic__", "default_login"), 
     e_match("valid", "failed"), e_set("__topic__", "login_failed_event")
  )
```
References
This function can be used in combination with other functions. For more information, see Transform complex JSON data.

e_if_else

Executes an operation based on the condition's result.

Syntax

e_if_else(Condition, Operation 1 if Condition evaluates to true, Operation 2 if Condition evaluates to false)

Parameters

Parameter Name	Type	Required	Description
Condition	Arbitrary	Yes	An expression or a combination of expressions. If the result is not a Boolean value, the system evaluates whether the condition is true or false.
Real-time operation	Global processing function	Yes	A global processing function or a combination of global processing functions.
Mock operation	Global processing function	Yes	A global processing function or a combination of global processing functions.

Response

Returns operation results based on different conditions.

Examples

If the value of the result field is ok or pass or if the value of the status field is 200, retain the log.

Raw log

result: ok
status: 400

result: Pass
status: 200

result: failure
status: 500

Transformation rule

e_if_else(
    op_or(e_match("result", r"(?i)ok|pass"), e_search("status== 200")), KEEP, DROP
)

Result: The first two logs are retained. The third log is discarded.
```
result: ok
status: 400
```
```
result: Pass
status: 200
```

e_switch

You can combine multiple conditions and operations.

Syntax
```
e_switch(Condition 1, Operation 1, ..., default=None)
```
Note
You must specify the Condition and Operation parameters in pairs.

Parameters

Parameter Name	Type	Required	Description
Condition	Arbitrary	Yes	An expression or a combination of expressions. If the result is not a Boolean value, the system evaluates whether the condition is true or false.
Operation	Global processing function	Yes	A global processing function or a combination of global processing functions.
default	Global processing function	No	A global processing function or a combination of global processing functions. If no specified conditions are met, the operation specified by the default parameter is performed.

Response

A log on which the specified operations are performed is returned.

Examples

If the value of the content field is 123, set the __topic__ field to Number. If the value of the data field is 123, set the __topic__ field to PRO.

Raw log

__topic__:  
age: 18
content: 123
name: maki
data: 342

__topic__:  
age: 18
content: 23
name: maki
data: 123

Transformation rule

e_switch(
    e_search("content==123"),
    e_set("__topic__", "Number", mode="overwrite"),
    e_search("data==123"),
    e_set("__topic__", "PRO", mode="overwrite"),
)

Result

__topic__: Number
age: 18
content: 123
name: maki
data: 342

__topic__: PRO
age: 18
content: 23
name: maki
data: 123

Combine the e_switch and e_output functions to deliver logs that meet specific rules to different Logstores. If `default=e_drop()` is set, logs that do not meet the rules are discarded and not delivered. If you do not set the `default` parameter, logs that do not meet the rules are delivered to the first configured Logstore.

Raw log

__topic__: sas-log-dns
test: aliyun

__topic__: aegis-log-network
test:ecs

__topic__: local-dns
test:sls

__topic__: aegis-log-login
test: sls

Transformation rule

e_switch(e_match("__topic__","sas-log-dns"),e_output(name="target1"),
e_match("__topic__","sas-log-process"),e_output(name="target2"),
e_match("__topic__","local-dns"),e_output(name="target3"),
e_match("__topic__","aegis-log-network"),e_output(name="target4"),
e_match("__topic__","aegis-log-login"),e_output(name="target5"),
default=e_drop())

References
This function can be used in combination with other functions. For more information, see Distribute data to multiple destination Logstores.

Functions

e_compose

Syntax

Parameters

Response

Examples

References

e_if

Syntax

Parameters

Response

Examples

References

e_if_else

Syntax

Parameters

Response

Examples

e_switch

Syntax

Parameters

Response

Examples

References