This article gives some examples on working with JavaScript. These are used in various places in Cribl solutions such as in filters, working with data, and creating dynamic expressions.
Note that certain JS methods may be more performant than others. Check out this blog for some test results and recommendations, especially when considering which ones to use in pipeline functions and filters. You'll also find more info and links at the bottom of this page.
Testing Out Expressions
You can test out expressions by using the pop-out editor found in several places. For example, in the Pipeline view, the Eval function has one on the 'Value Expression' module (red box):
After clicking it, we can use the top box to test out our expressions:
Let's go through some examples using the following sample log. Note that you can copy and paste this into the "Sample input" window above to test these out.
{
"_raw": "simple log",
"server": "app_nginx_01",
"role": "webserver",
"sentence": "this is a group of Words so we can test some jscript stuff"
}
Evaluating with Strings
indexOf - Returns the index of the first occurrence of the specified string. Very performant and can be used for filtering (if the string is NOT found, it evaluates to -1; a filter looking for a positive match could be result > -1)
sentence.indexOf('Words') — evaluates to 19
sentence.indexOf('words') — evaluates to -1
startsWith - Check beginning of the field
server.Startswith('app') — evaluates to TRUE
endsWith - Check end of the field
server.endsWith('_01') — evaluates to TRUE
includes - Find a string anywhere in the field
server.includes('nginx') — evaluates to TRUE
Evaluating with Regular Expressions
test - Look for a regular expression in a field and give a boolean result
/\sWords\s/.test(sentence) — evaluates to TRUE
match - Look for a regular expression in a field and return the matchin an array
sentence.match(/jscript/) — evaluates to an array with a value of "jscript"
Working on Data / Value Expressions / Logical Operators
replace - Replace characters
Example usage: replace any spaces with nothing (ie remove them)
sentence.replace(/\s/g,"") — evaluates to "thisisagroupofWordssowecantestsomejscriptstuff"
if / else - Conditional statements
Example: check for a value for 'server' and output 'yes' or 'no'
server=='app_nginx_01' ? 'yes' : 'no'— evaluates to "yes"
and / or / not - Logical operators
Example: check for two or more conditions with AND
server=='app_nginx_01'&& role=='webserver'— evaluates to TRUE
Example: check for at least one condition with OR
server=='app_nginx_01'|| role=='dbserver'— evaluates to TRUE
Example: check for a negative condition with NOT
server!='app_nginx_01'— evaluates to FALSE
length - Get the character count
server.length — evaluates to "12"
Using Variables
Variables can be useful for many purposes, such as constructing dynamic partitioning expressions for writing events to object storage.
Example (note the backticks at the beginning and end):
`${server}-${role}`— evaluates to "app_nginx_01-webserver"
Additional Resources
