Skip to content

case_equals - Shorthand for case for equals operations

This shorthand will allow users to quickly define case statements based on string == logic. It is very useful for shortening queries that would otherwise have to repeat conditional statements over and over.

NOTE: This case statement, like all case statements, will return the first matching value. This means the order of your clauses in your case statement are extremely important.

Syntax

case_equals {
  e: any,
  value1 -> result1,
  value2 -> result2,
  ...
  valueN -> resultN
  _      -> default
}

Example - Flagging different environments for alerting:

Our goal is to add a field, should_alert which is true is alerts should fire for this environment, and false if alerts should be ignored. Consider the following log documents:

{
  cluster_name: acme-prod-cluster,
  ...
},
{
  cluster_name: acme-dev-cluster,
  ...
},
{
  cluster_name: acme-stg-cluster
}

We can see from the cluster name what our environment should be, and we're able to map the cluster name to our new value:

case_equals {
  $d.cluster_name,
  'acme-prod-cluster' -> true,
  'acme-dev-cluster'  -> false,
  'acme-stg-cluster'  -> true,
  _        -> false
}

We can then save the output of this into a new field, like so:

create should_alert from 
  case_equals {
    $d.cluster_name,
    'acme-prod-cluster' -> true,
    'acme-dev-cluster'  -> false,
    'acme-stg-cluster'  -> true,
    _        -> false
  }