Event Information Query Functions
LogScale's event information functions allow event information and field selection. These are designed to work with event fields, rather than the data within the event.
Table: Event Information Query Functions
| Function | Default Argument | Availability | Description |
|---|---|---|---|
copyEvent(type) | type | Duplicates event so pipeline will see both events. | |
createEvents(rawstring) | rawstring | Generates temporary events as part of the query. | |
default(field, [replaceEmpty], value) | value | Creates a field to given parameter and given value. | |
drop(fields) | fields | Removes attributes or columns from a result set. | |
dropEvent() | Drops completely an event in parser pipeline to stop it from being ingested. | ||
eventFieldCount([as]) | Computes number of fields event uses internally for the values. | ||
eventInternals([prefix]) | Add a set of fields describing the storage locations of this event. | ||
eventSize([as]) | Determines the number of bytes that this event uses internally for the values, not counting the bytes for storing the field names. | ||
fieldset() | Retrieves a list of available fields. | ||
fieldstats([limit]) | Retrieves stats about fields. | ||
hash([as], field, [limit], [seed]) | field | Computes a non-cryptographic hash of a list of fields. | |
rename([as], field) | field | Renames one or more given fields. | |
select(fields) | fields | Used to specify a set of fields to select from each event. | |
test(expression) | expression | Evaluates boolean expression and filters events. |