Skip to content

case_equals

Description

Returns a value based on whether an expression equals one of several specified values.

This function is a shorthand for case expressions with equality (==) logic and helps shorten queries that would otherwise repeat conditional statements.

Note

Like all case statements, case_equals returns the first matching value. The order of clauses is important.

Syntax

case_equals {
e: any,
value1 -> result1,
value2 -> result2,
...
valueN -> resultN,
_      -> default
}

Arguments

NameTypeRequiredDescription
eanytrueThe expression to compare against values
valueanytrueA value to compare with e
resultanytrueThe value to return if e equals value
_anyfalseDefault value if no values match

Example

Use case: Flag environments for alerting

Suppose you want to create a field should_alert that is true for environments where alerts should fire and false otherwise. Consider these log documents:

{
  "cluster_name": "acme-prod-cluster"
},
{
  "cluster_name": "acme-dev-cluster"
},
{
  "cluster_name": "acme-stg-cluster"
}
create should_alert from 
  case_equals {
    $d.cluster_name,
    'acme-prod-cluster' -> true,
    'acme-dev-cluster'  -> false,
    'acme-stg-cluster'  -> true,
    _                   -> false
  }

Output

{
  "cluster_name": "acme-prod-cluster",
  "should_alert": true
},
{
  "cluster_name": "acme-dev-cluster",
  "should_alert": false
},
{
  "cluster_name": "acme-stg-cluster",
  "should_alert": true
}