v(Field name)
Parameter | Description | Parameter Type | Required | Default Value | Value Range |
field | Field name | string | Yes | - | - |
{"message": "failed", "status": "500"}
fields_set("new_message", v("message"))
{"message": "failed", "new_message": "failed","status": "500"}
fields_drop(Field name 1, Field name 2, ..., regex=False,nest=False)
Parameter | Description | Parameter Type | Required | Default Value | Value Range |
Variable parameter, which can be a field name or regular expression of the field name | Variable parameter, which can be a field name or regular expression of the field name | string | Yes | - | - |
regex | Whether to enable regular expression and use the full match mode | bool | No | False | - |
nest | Whether the field is a nested field | bool | No | False | - |
{"field": "a,b,c", "status": "500"}
fields_drop("field")
{"status":"500"}
{"condition":"{\\"a\\":\\"aaa\\", \\"c\\":\\"ccc\\", \\"e\\":\\"eee\\"}","status":"500"}
// `nest=True` indicates that the field is a nested field. After `condition.a` and `condition.c` are deleted, only the `condition.e` field is left.t_if(if_json(v("condition")), fields_drop("condition.a", "condition.c", nest=True))
{"condition":"{\\"e\\":\\"eee\\"}","status":"500"}
{"App": "thcomm","Message": "{\\"f_httpstatus\\": \\"200\\",\\"f_requestId\\": \\"2021-11-09 08:40:17.832\\tINFO\\tservices/http_service.go:361\\tbb20ac02-fcbc-4a56-b1f1-4064853b79da\\",\\"f_url\\": \\"wechat.wecity.qq.com/trpcapi/MbpsPaymentServer/scanCode\\"}"}
// `nest=True` indicates that the filed is a nested field. After `Message.f_requestId` and `Message.f_url` are deleted, only the `f_httpstatus` field is left.t_if(if_json(v("Message")), fields_drop("Message.f_requestId", "Message.f_url", nest=True))
{"App":"thcomm","Message":"{\\"f_httpstatus\\":\\"200\\"}"}
fields_keep(Field name 1, Field name 2, ..., regex=False)
Parameter | Description | Parameter Type | Required | Default Value | Value Range |
Variable parameter, which can be a field name or regular expression of the field name | Variable parameter, which can be a field name or regular expression of the field name | string | Yes | - | - |
regex | Whether to enable regular expression and use the full match mode | bool | No | False | - |
{"field": "a,b,c", "status": "500"}
fields_keep("field")
{"field":"a,b,c"}
fields_pack(Target field name, include=".*", exclude="", drop_packed=False)
Parameter | Description | Parameter Type | Required | Default Value | Value Range |
output | Name of the new field after encapsulation | string | Yes | - | - |
include | Regular expression to include the field name | string | No | - | - |
exclude | Regular expression to exclude the field name | string | No | - | - |
drop_packed | Whether to delete the original fields that are encapsulated | bool | No | False | - |
{"field_a": "a,b,c","field_b": "abc", "status": "500"}
fields_pack("new_field","field.*", drop_packed=False)
{"new_field":"{\\"field_a\\":\\"a,b,c\\",\\"field_b\\":\\"abc\\"}","field_a":"a,b,c","field_b":"abc","status":"500"}
fields_set(Field name 1, Field value 1, Field name 2, Field value 2, mode="overwrite")
Parameter | Description | Parameter Type | Required | Default Value | Value Range |
Variable parameter | List of key-value pairs | string | - | - | - |
mode | Field overwrite mode | string | No | overwrite | - |
{"Level": "Info"}
fields_set("Level", "Warning")
{"Level", "Warning"}
new
and new2
Raw log:{"a": "1", "b": "2", "c": "3"}
fields_set("new", v("b"), "new2", v("c"))
{"a":"1","b":"2","c":"3","new":"2","new2":"3"}
fields_rename(Field name 1, New field name 1, Field name 2, New field name 2, regex=False)
Parameter | Description | Parameter Type | Required | Default Value | Value Range |
Variable parameter | List of original-new field name pairs | string | - | - | - |
regex | Whether to enable regular expression match for field names. If yes, use a regular expression to match the original field name. If no, use equal match. | bool | No | False | - |
{"regieeen": "bj", "status": "500"}
fields_rename("reg.*", "region", regex=True)
{"region":"bj","status":"500"}
True
. Otherwise, the function returns False
.has_field(Field name)
Parameter | Description | Parameter Type | Required | Default Value | Value Range |
field | Field name | string | Yes | - | - |
{"regiooon": "bj", "status": "500"}
t_if(has_field("regiooon"), fields_rename("regiooon", "region"))
{"region":"bj","status":"500"}
True
. Otherwise, the function returns False
.not_has_field(Field name)
Parameter | Description | Parameter Type | Required | Default Value | Value Range |
field | Field name | string | Yes | - | - |
{"status": "500"}
t_if(not_has_field("message"), fields_set("no_message", True))
{"no_message":"TRUE","status":"500"}
Apakah halaman ini membantu?