Log processing functions - Bitwise operations

AND

numeric_expr1 & numeric_expr2

BITWISE_AND(numeric_expr1, numeric_expr2)

Bitwise AND between numeric expressions.

BITWISE_AND(ipaddr, numeric_expr)

Bitwise AND between IPADDR and numeric arguments.

output type
LONG or IPADDR depending on input argument types.

Example:

plaintextcopydownload
FIELDS_ADD(and_op:(ip & 0xffff), and_fn:BITWISE_AND(i, 0xffff));

OR

numeric_expr1 | numeric_expr2

BITWISE_OR(numeric_expr1, numeric_expr2)

Bitwise OR between numeric expressions.

output type
LONG

Example:

plaintextcopydownload
FIELDS_ADD(or_op:(i | 1), or_fn:BITWISE_OR(d, 0xffff));

XOR

numeric_expr1 ^ numeric_expr2

BITWISE_XOR(numeric_expr1, numeric_expr2)

Bitwise XOR (exclusive or) between numeric expressions.

output type
LONG

Example:

plaintextcopydownload
FIELDS_ADD(xor_op:(i ^ 1), xor_fn:BITWISE_XOR(d, 0xffff));

LEFT_SHIFT

numeric_expr1 << numeric_expr2

LEFT_SHIFT(numeric_expr1, numeric_expr2)

Bitwise shift left numeric_expr1 by number of bits numeric_expr2.

output type
LONG

Example:

plaintextcopydownload
FIELDS_ADD(lshift_op:(i << 1), lshift_fn:LEFT_SHIFT(d, 2));

RIGHT_SHIFT

numeric_expr1 >> numeric_expr2

RIGHT_SHIFT(numeric_expr1, numeric_expr2)

Bitwise shift right numeric_expr1 by number of bits numeric_expr2.

output type
LONG

Example:

plaintextcopydownload
FIELDS_ADD(rshift_op:i >> 1, rshift_fn:RIGHT_SHIFT(d, 2));

ZERO_FILL_RIGHT_SHIFT

numeric_expr1 >>> numeric_expr2

ZERO_FILL_RIGHT_SHIFT(numeric_expr1, numeric_expr2)

Unsigned bitwise shift right numeric_expr1 by the number of bits of numeric_expr2 (shifts zero into leftmost position).

output type
LONG

Example:

plaintextcopydownload
FIELDS_ADD(rshift_op:i >>> 1, rshift_fn:ZERO_FILL_RIGHT_SHIFT(d, 2));

BITWISE_NOT

~ numeric_expr

BITWISE_NOT(numeric_expr)

Inverts the bits of numeric_expr.

output type
LONG

Example:

plaintextcopydownload
FIELDS_ADD(not_op:~i, not_fn:BITWISE_NOT(i));

BIT_COUNT

BIT_COUNT(numeric_expr)

Returns count of bits set to 1 of numeric_expr.

output type
LONG

Example:

plaintextcopydownload
FIELDS_ADD(BIT_COUNT(1));