peval
Description
Performs various operations on the data. It is based on internal storage mechanisms.
danger
Using peval
in a query is allowed if it is preceded only by commands that also work with internal storage mechanisms. These include source
and search
. This condition must also be met for all subqueries in the query.
Syntax
| peval <field>=<expression>["," <field>=<expression>]...
Parameter | Syntax | Description |
---|---|---|
field | <string> | Name of the field with the result of the operation. |
expression | <expression> | The operation (computation) or a set of operations to be performed to create the new field. |
Data Types
eval
operates with the following basic data types and attempts to retain the original or assigned data type in the response:
string
numeric
boolean
null
multivalue
info
Multivalues
represent arrays of values, where each element is a basic data type.
OpenSearch Specifics
- Scripts in OpenSearch handle numeric field types or keyword types for text fields. For text fields, you need to append
<field name>.keyword
. - Regular expressions must be wrapped in the
regex
function to ensure proper OpenSearch script handling:- Syntax:
regex("<regular expression>")
- Syntax:
- Allows executing custom painless scripts during command execution using the
_script
function:- Syntax:
_script("<script>", (<arg_name>, <arg_value>)...)
:::
- Syntax:
Examples
Example #1
source nix_events-*
| search host="SPB-*"
| peval agent= agent.keyword + port
| search agent="*log*77"
| aggs values(per_number) by agent