case

Description

Returns a value from the first clause whose condition evaluates to true.

Each clause is a condition -> value pair: when condition evaluates to true, case returns value. You can include any number of clauses, plus an optional _ -> default fallback. If no condition matches and no fallback is present, case returns null.

Syntax

case {
condition1 -> value1,
condition2 -> value2,
...
conditionN -> valueN,
_          -> default
}

Arguments

Example

Use case: Map server IPs to owners by subnet

Suppose you want to enrich logs with the owner of each server based on its IP address. This can help route incidents to the right team.

You can use the ipInSubnet function inside a case statement to determine ownership. If no subnet matches, a default owner is assigned.

Example data

{
  "server_ip": "10.0.0.1"
},
{
  "server_ip": "165.0.0.1"
},
{
  "server_ip": "333.4.5.6"
}

Example query

create server_owner from
case {
  ipInSubnet(server_ip, '10.0.0.0/8')   -> 'Chris',
  ipInSubnet(server_ip, '165.0.0.0/8')  -> 'George',
  ipInSubnet(server_ip, '333.4.0.0/16') -> 'Maya',
  _                                     -> 'DevOps Team'
}

Example output

{
  "server_ip": "10.0.0.1",
  "server_owner": "Chris"
},
{
  "server_ip": "165.0.0.1",
  "server_owner": "George"
},
{
  "server_ip": "333.4.5.6",
  "server_owner": "Maya"
}