format
Description
Converts the results from the previous part of a search query into a logical expression for further search. Converts the results of the previous part of the search query into a logical expression for searching. Used inside the subquery search [ ... | format ] to dynamically form a filter condition based on data from another source.
Avoid forming excessively long search query strings after formatting the query. This may exceed the maxClauseCount limit in SA Data Storage and cause a query execution error.
Syntax
| format
Query Examples
Example 1
In this example, format converts a list of users from the zabbix index matching the pattern Iv* into a logical expression. This expression is then applied as a filter condition in active_directory - as a result, only events where the user field matches the found values remain.
Index zabbix:
| @timestamp | user |
|---|---|
| 2026-06-24T10:00:00Z | Ivanov |
| 2026-06-24T10:01:00Z | Ivanenko |
| 2026-06-24T10:02:00Z | Petrov |
| 2026-06-24T10:03:00Z | Sidorov |
Index active_directory:
| @timestamp | user | department | host |
|---|---|---|---|
| 2026-06-24T10:00:00Z | Ivanov | IT | pc-01 |
| 2026-06-24T10:01:00Z | Ivanenko | HR | pc-02 |
| 2026-06-24T10:02:00Z | Petrov | Finance | pc-03 |
| 2026-06-24T10:03:00Z | Sidorov | IT | pc-04 |
source active_directory | search [ source zabbix | search user="Iv*" | fields user | format]
format forms an expression like (user="Ivanov" OR user="Ivanenko") from the subquery results. Petrov and Sidorov do not appear in the result because they don't match the Iv* pattern:
| @timestamp | user | department | host |
|---|---|---|---|
| 2026-06-24T10:00:00Z | Ivanov | IT | pc-01 |
| 2026-06-24T10:01:00Z | Ivanenko | HR | pc-02 |
Example 2
In this example, format forms a search condition based on a calculated value. makeresults creates one row, eval calculates round(pi()) = 3 and writes the result to the id field. The format command converts this into an expression (id=3), which is used to filter the users index.
Index users:
| @timestamp | id | name | role |
|---|---|---|---|
| 2026-06-24T10:00:00Z | 1 | Alice | viewer |
| 2026-06-24T10:01:00Z | 2 | Bob | editor |
| 2026-06-24T10:02:00Z | 3 | Charlie | admin |
| 2026-06-24T10:03:00Z | 4 | Dave | viewer |
source users
| search
[ | makeresults
| eval id=round(pi())
| fields id
| format ]
As a result, only the record with id = 3 is returned:
| @timestamp | id | name | role |
|---|---|---|---|
| 2026-06-24T10:02:00Z | 3 | Charlie | admin |
Example 3
In this example, components DC are extracted from the distinguishedname field in the ad_computer index using rex, then joined with dots by the eval command. The resulting domainUser value forms a search condition through format, which is applied to the ad_users index - only users from the vv.local domain remain.
Index ad_computer:
| @timestamp | distinguishedname |
|---|---|
| 2026-06-24T10:00:00Z | CN=Ivanov Ivan,OU=Employees, DC=vv,DC=local |
| 2026-06-24T10:01:00Z | CN=Petrov Petr,OU=Employees, DC=vv,DC=local |
Index ad_users: | |
| @timestamp | domainUser |
| --- | --- |
| 2026-06-24T10:00:00Z | vv.local |
| 2026-06-24T10:01:00Z | vv.local |
| 2026-06-24T10:02:00Z | other.domain |
source ad_users
| search
[ source ad_computer
| rex field=distinguishedname "DC=(?<DC>[a-z]*)" max_match=0
| eval domainUser=mvjoin(DC, ".")
| stats count by domainUser
| fields domainUser
| format ]
rex extracts DC components (vv and local), mvjoin assembles them into the string vv.local, format forms the expression (domainUser="vv.local"). User smith from the other.domain domain does not appear in the result:
| @timestamp | domainUser | login | department |
|---|---|---|---|
| 2026-06-24T10:00:00Z | vv.local | ivanov | IT |
| 2026-06-24T10:01:00Z | vv.local | petrov | Finance |