Log processing functions - Bitwise operations
AND
numeric_expr1 & numeric_expr2
BITWISE_AND(numeric_expr1, numeric_expr2)
Bitwise AND between numeric expressions.
BITWISE_AND(ipaddr, numeric_expr)
Bitwise AND between IPADDR and numeric arguments.
output type
LONG
or IPADDR
depending on input argument types.
Example:
FIELDS_ADD(and_op:(ip & 0xffff), and_fn:BITWISE_AND(i, 0xffff));
and_op | and_fn |
---|---|
0.0.255.255 | 65535 |
OR
numeric_expr1 | numeric_expr2
BITWISE_OR(numeric_expr1, numeric_expr2)
Bitwise OR between numeric expressions.
output type
LONG
Example:
FIELDS_ADD(or_op:(i | 1), or_fn:BITWISE_OR(d, 0xffff));
or_op | or_fn |
---|---|
1 | 65535 |
XOR
numeric_expr1 ^ numeric_expr2
BITWISE_XOR(numeric_expr1, numeric_expr2)
Bitwise XOR (exclusive or) between numeric expressions.
output type
LONG
Example:
FIELDS_ADD(xor_op:(i ^ 1), xor_fn:BITWISE_XOR(d, 0xffff));
xor_op | xor_fn |
---|---|
0 | 65534 |
LEFT_SHIFT
numeric_expr1 << numeric_expr2
LEFT_SHIFT(numeric_expr1, numeric_expr2)
Bitwise shift left numeric_expr1 by number of bits numeric_expr2.
output type
LONG
Example:
FIELDS_ADD(lshift_op:(i << 1), lshift_fn:LEFT_SHIFT(d, 2));
lshift_op | lshift_fn |
---|---|
2 | 4 |
RIGHT_SHIFT
numeric_expr1 >> numeric_expr2
RIGHT_SHIFT(numeric_expr1, numeric_expr2)
Bitwise shift right numeric_expr1 by number of bits numeric_expr2.
output type
LONG
Example:
FIELDS_ADD(rshift_op:i >> 1, rshift_fn:RIGHT_SHIFT(d, 2));
rshift_op | rshift_fn |
---|---|
32767 | 16383 |
ZERO_FILL_RIGHT_SHIFT
numeric_expr1 >>> numeric_expr2
ZERO_FILL_RIGHT_SHIFT(numeric_expr1, numeric_expr2)
Unsigned bitwise shift right numeric_expr1 by the number of bits of numeric_expr2 (shifts zero into leftmost position).
output type
LONG
Example:
FIELDS_ADD(rshift_op:i >>> 1, rshift_fn:ZERO_FILL_RIGHT_SHIFT(d, 2));
rshift_op | rshift_fn |
---|---|
1073741824 | 536870912 |
BITWISE_NOT
~ numeric_expr
BITWISE_NOT(numeric_expr)
Inverts the bits of numeric_expr.
output type
LONG
Example:
FIELDS_ADD(not_op:~i, not_fn:BITWISE_NOT(i));
not_op | not_fn |
---|---|
-1 | -1 |
BIT_COUNT
BIT_COUNT(numeric_expr)
Returns count of bits set to 1 of numeric_expr.
output type
LONG
Example:
FIELDS_ADD(BIT_COUNT(1));
bit_count |
---|
1 |