case_equals - Shorthand for case for equals operations
This shorthand will allow users to quickly define case statements based on string ==
logic. It is very useful for shortening queries that would otherwise have to repeat conditional statements over and over.
NOTE: This case statement, like all case statements, will return the first matching value. This means the order of your clauses in your case statement are extremely important.
Syntax
Example - Flagging different environments for alerting:
Our goal is to add a field, should_alert
which is true
is alerts should fire for this environment, and false
if alerts should be ignored. Consider the following log documents:
{
cluster_name: acme-prod-cluster,
...
},
{
cluster_name: acme-dev-cluster,
...
},
{
cluster_name: acme-stg-cluster
}
We can see from the cluster name what our environment should be, and we're able to map the cluster name to our new value:
case_equals {
$d.cluster_name,
'acme-prod-cluster' -> true,
'acme-dev-cluster' -> false,
'acme-stg-cluster' -> true,
_ -> false
}
We can then save the output of this into a new field, like so:
create should_alert from
case_equals {
$d.cluster_name,
'acme-prod-cluster' -> true,
'acme-dev-cluster' -> false,
'acme-stg-cluster' -> true,
_ -> false
}
Theme
Light