Predefined Functions
A list of functions that are available in the EQL.
The conversion functions are typically used when adding a new data model, or when you need to define new columns, where the expressions for new columns can use conversion functions to convert between data types and combine them using various operators. For instructions on how to add a new data model, see Adding a Data Model in Graphical Mode.
Function Name | Arguments | Returns |
---|---|---|
ToTimestamp | (expression, formatString) or (expression, formatString, timezone) or (expression, formatString, timezone, defaultValue) | The expression, which should evaluate to a string, is interpreted as a time according to the supplied formatString. If the conversion fails, null is returned, unless a default string is provided, which is interpreted as a time and returned.
Example:
ToTimestamp( logFileStringTimestampField, "dd, MM, yyyy HH:mm:ss", "America/ Los_Angeles", "01, 01, 1970 00:00:00")
If formatString does not contain a year, then when the function is being evaluated in the context of processing an event, the year from the event time (sys_eventTime) is used. If this results in a timestamp that is later than the event time, the prior year is used. |
ToIP | (expression) or (expression, defaultValue) | Convert the expression to an IP address (Java InetAddress). If the conversion fails, null is returned, unless a default string is provided, which is interpreted as an IP address and returned.
Example: ToIP(ipAddressField, "10.0.0.1") |
ToTimestampString | (expression, formatString) or (expression, formatString, timezone) or (expression, formatString, timezone, defaultValue) | Same as ToTimestamp, except it gets converted to string to get a printable timestamp.
Example: ToTimestampString(timestamp , "dd, MM, yyyy HH:mm:ss", "America/Los_Angeles", "01, 01, 1970 00:00:00") Note: If timezone is omitted or is empty, the system default timezone is used. |
ToInt | (expression) or (expression, defaultValue) | The obvious conversion to integer with default value taken if not convertible.
Example: ToInt("1348") or ToInt(numberField, 0) |
ToLong | (expression) or (expression, defaultValue) | The obvious conversion to Long with default value taken if not convertible.
Example: ToLong("1348") or ToLong(numberField, 0) |
ToString | (expression) or (expression, defaultValue) | The obvious conversion to String with default value taken if not convertible.
Example: ToString(124.5) or ToString(numberField, "null") |
ToFloat | (expression) or (expression, defaultValue) | The obvious conversion to Float with default value taken if not convertible.
Example: ToFloat("1348.2") or ToLong(numberField, 0.0) Note: LogLogic LMI uses double precision (that is 64 bits) when storing floating point numbers. |
ToBool | (expression) or (expression, defaultValue) | The obvious conversion to Boolean with default value taken if not convertible.
Example: ToBool("FALSE") or ToBool(col1, FALSE) |
ExtractJson | (expression, extraction path) or (expression, extraction path, default value) | The expression, which is a JSON string is parsed. A field is extracted from the expression using the extraction path. If either the expression or the path are invalid, an optional default value is returned.
Example: ExtractJson("{"cat": {"color":" blue"}}", "cat.color", "burlesque") returns a string "blue" which is a JSON value of color, which is a JSON value of cat. |
ExtractKvp | (expression, extraction path) or (expression, extraction path, nested KVP delimiters /default "{}"/) or (expression, extraction path, nested KVP, deliiter / default ","/) or (expression, extraction path, nested KVP, delimiter, separator /default "="/) or (expression, extraction path, nested KVP, delimiter, separator, escape character / default "\\"/) or (expression, extraction path, nested KVP, delimiter, separator, escape character, default value) | The expression, which is a nested KVP string is parsed. A field is extracted from the expression using the extraction path. If either the expression or the path are invalid, an optional default value is returned.
Example: ExtractKvp(" alert={ agent={ hostname=esbqa01, dns=none}}" , "alert.agent.dns") returns a string "none". or ExtractKvp("(abc^def|asd^aaa)" , "asd", "()", "|", "^") returns "aaa". |
Function Name | Arguments | Returns |
---|---|---|
NaturalEqualTo | (arg1, arg2) | |
NaturalNotEqualTo | (arg1, arg2) |
Function Name | Arguments | Returns |
---|---|---|
Power | base, exponent | Returns the value of base raised to the power of exponent. Any null argument returns null. |
Round | (numeric) or (numeric, [integer]) | Returns a FLOAT value of the numeric argument rounded to the number of decimal places specified by
integer. The argument
integer is optional, and the default value is zero if not provided.
The numeric value is rounded mid-way and away from zero. A null argument returns null. If the second argument is positive, it represents the number of decimal places to the right of the decimal point, whereas if it is negative, it represents the number of places to the left of the decimal point which become a zero. |
Sqrt | numeric | Returns the square root of the argument or null if the argument is null. |
Function Name | Arguments | Returns |
---|---|---|
IIF | Condition, then, else | Returns the value of the 'then' clause if the condition is true, otherwise the value of the 'else' clause .
Example: IIF(true, “a”, “b”) returns “a” if true and “b” if false |
Function Name | Arguments | Returns |
---|---|---|
Seconds | Timestamp | Truncates the specified timestamp parameter to the second. |
Minutes | Timestamp | Truncates the specified timestamp parameter to the minute. |
Hours | Timestamp | Truncates the specified timestamp parameter to the hour. |
Days | Timestamp | Truncates the specified timestamp parameter to the day. |
Weeks | Timestamp | Truncates the specified timestamp parameter to the week |
Months | Timestamp | Truncates the specified timestamp parameter to the month. |
Years | Timestamp | Truncates the specified timestamp parameter to the year. |