Event operation functions
Updated at：2025-11-03
Event operation functions
Introduction
Functions for processing a single line of logs, including filtering, distribution, splitting, etc.
e_drop function
Function definition
Discard logs that meet the conditions.
Syntax description
Text
1e_drop(condition)Parameter description
| Parameter name | Parameter description | Parameter type | Required or not | Parameter default | Parameter range |
|---|---|---|---|---|---|
| Condition | A function expression with a value of bool type | Bool | Yes | - | - |
Example
- Example 1
Original log:
Text
1[
2 {
3 "field": "a,b,c",
4 "status": "500"
5 },
6 {
7 "field": "a,b,c",
8 "status": "200"
9 }
10]Processing rules:
Text
1e_drop(v("status")=="500")Processing results:
Text
1[
2 {
3 "field": "a,b,c",
4 "status": "200"
5 }
6]e_keep function
Function definition
Retain logs that meet the conditions.
Syntax description
Text
1e_keep(condition)Parameter description
| Parameter name | Parameter description | Parameter type | Required or not | Parameter default | Parameter range |
|---|---|---|---|---|---|
| Condition | A function expression with a value of bool type | Bool | Yes | - | - |
Example
- Example 1
Original log:
Text
1[
2 {
3 "field": "a,b,c",
4 "status": "500"
5 },
6 {
7 "field": "a,b,c",
8 "status": "200"
9 }
10]Processing rules:
Text
1e_keep(v("status")=="500")Processing results:
Text
1[
2 {
3 "field": "a,b,c",
4 "status": "500"
5 }
6]