Log processing functions - Casting

BOOLEAN

BOOLEAN(string)

Returns TRUE on following string values: T, t, Y, y, 1, YES, yes, TRUE, true.

Returns NULL if string argument evaluates to NULL.

Returns FALSE on any other string value.

output type
BOOLEAN

Example:

plaintext
FIELDS_ADD(bval:BOOLEAN('T'));

bval
true

BOOLEAN(numeric_expr)

numeric_expr value 0 is converted to false, other values to true.

Returns NULL if numeric_expr evaluates to NULL.

output type
BOOLEAN

Example:

plaintext
FIELDS_ADD(bval:BOOLEAN(i));

bval
false
true
true

BYTES

BYTES(string)

Converts string argument to BYTES. Returns NULL if string evaluates to NULL.

output type
BYTES

Example:

plaintext
FIELDS_ADD(b:BYTES('01'));

b
[48,49]

BYTES(numeric_array)

Converts numeric_array values to BYTES. Returns NULL if numeric_array evaluates to NULL.

output type
BYTES

Example:

plaintext
FIELDS_ADD(b:BYTES([1023,1024,1]));

b
[-1,0,1]

DOUBLE

DOUBLE(numeric_expr)

Converts numeric_expr to DOUBLE. Returns NULL if numeric_expr evaluates to NULL.

output type
DOUBLE

Example

plaintext
FIELDS_ADD(d:DOUBLE(2 * 300));

d
600.0

DOUBLE(string)

Converts string argument to DOUBLE. Returns NULL if string evaluates to NULL.

output type
DOUBLE

Example

plaintext
FIELDS_ADD(d:DOUBLE("-4"));

d
-4.0

DURATION

DURATION(nanoseconds)

Converts numeric nanoseconds value to DURATION. Returns NULL if nanoseconds evaluates to NULL.

output type
DURATION

Example

plaintext
FIELDS_ADD(DURATION(1000*60*60*24*30*1000000));

duration
30 days, 00:00:00.000

INTEGER

INTEGER, INT(numeric_expr)

Converts numeric_expr to INTEGER. Returns NULL if numeric_expr evaluates to NULL.

output type
INTEGER

Example

plaintext
FIELDS_ADD(i:INT(2.498));

i
2

INTEGER, INT(string)

Converts string argument to INTEGER. Returns NULL if string evaluates to NULL.

output type
INTEGER

Example

plaintext
FIELDS_ADD(i:INT("-4"));

i
-4

INTEGER, INT(timestamp)

Converts timestamp argument to INTEGER. Returns NULL if timestamp evaluates to NULL.

output type
INTEGER

Example

plaintext
FIELDS_ADD(i:INT(TIMESTAMP("2019-03-14 22:41:55.000 +0000")));

i
1552603315

IPADDR

IPADDR(numeric_expr), IPV4(numeric_expr)

Converts numeric_expr arg to IPADDR. Returns NULL if numeric_expr evaluates to NULL.

output type
IPADDR

Example

plaintext
FIELDS_ADD(ip:IPADDR(-1062731520));

ip
192.168.1.0

IPADDR(hi_64_bit_num, low_64_bit_num), IPV6(IPADDR(hi_64_bit_num, low_64_bit_num))

Converts 128-bit numeric argument to IPADDR. Returns NULL if arguments evaluate to NULL.

output type
IPADDR

Example

plaintext
FIELDS_ADD(ip:IPADDR(1,1));

ip
::1:0:0:0:1

IPADDR(string), IPV4(string), IPV6(string)

Converts string arg to IPADDR. Returns NULL if string evaluates to NULL.

output type
IPADDR

Example

plaintext
FIELDS_ADD(ip:IPADDR("192.168.1.0"));

ip
192.168.1.0

LONG

LONG(numeric_expr)

Converts numeric_expr to LONG. Returns NULL if numeric_expr evaluates to NULL.

output type
LONG

Example

plaintext
FIELDS_ADD(l:LONG(2.498));

l
2

LONG(string)

Converts string argument to LONG. Returns NULL if string evaluates to NULL.

output type
LONG

Example

plaintext
FIELDS_ADD(l:LONG("-4"));

l
-4

STRING

STRING(expr)

Converts expr returning any type to STRING. Returns NULL if expr evaluates to NULL.

output type
STRING

Example

plaintext
FIELDS_ADD(int_str:STRING(i), double_str:STRING(d), ip_str:STRING(ip));

int_str	double_str	ip_str
0	0.0	0.0.0.0
1	1.0	0.0.0.1
2	2.0	0.0.0.2

TIMESTAMP

TIMESTAMP(integer), T(integer)

Converts integer seconds elapsed from Unix epoch to TIMESTAMP.

Returns NULL if integer evaluates to NULL.

output type
TIMESTAMP

Example

plaintext
FIELDS_ADD(TIMESTAMP(1552603315));

timestamp
2019-03-14 22:41:55.333000000 +0000

TIMESTAMP(long), T(long)

Converts long milliseconds elapsed from Unix epoch to TIMESTAMP.

Returns NULL if long evaluates to NULL.

output type
TIMESTAMP

Example

plaintext
FIELDS_ADD(T(1552603315l*1000+333));

timestamp
2019-03-14 22:41:55.333000000 +0000

TIMESTAMP(year, month, day), T(year, month, day)

Converts date specified by integer arguments to TIMESTAMP. Returns NULL if arguments evaluate to NULL.

output type
TIMESTAMP

Example

plaintext
FIELDS_ADD(TIMESTAMP(2019,03,14));

timestamp
2019-03-14 00:00:00.000000000 +0000

TIMESTAMP(year, month, day, hour), T(year, month, day, hour)

Converts date and time specified by integer arguments to TIMESTAMP. Returns NULL if arguments evaluate to NULL.

output type
TIMESTAMP

Example

plaintext
FIELDS_ADD(TIMESTAMP(2019,03,14,22));

timestamp
2019-03-14 22:00:00.000000000 +0000

TIMESTAMP(year, month, day, hour, minutes), T(year, month, day, hour, minutes)

Converts date and time specified by integer arguments to TIMESTAMP. Returns NULL if arguments evaluate to NULL.

output type
TIMESTAMP

Example

plaintext
FIELDS_ADD(TIMESTAMP(2019,03,14,22,41));

timestamp
2019-03-14 22:41:00.000000000 +0000

TIMESTAMP(year, month, day, hour, minutes, seconds), T(year, month, day, hour, minutes, seconds)

Converts date and time specified by integer arguments to TIMESTAMP. Returns NULL if arguments evaluate to NULL.

output type
TIMESTAMP

Example

plaintext
FIELDS_ADD(TIMESTAMP(2019,03,14,22,41,55));

timestamp
2019-03-14 22:41:55.000000000 +0000

TIMESTAMP(year, month, day, hour, minutes, seconds, milliseconds)

T(year, month, day, hour, minutes, seconds, milliseconds)

Converts date and time specified by integer arguments to TIMESTAMP. Returns NULL if arguments evaluate to NULL.

output type
TIMESTAMP

Example

plaintext
FIELDS_ADD(TIMESTAMP(2019,03,14,22,41,55,333));

timestamp
2019-03-14 22:41:55.333000000 +0000

TIMESTAMP(string), T(string)

Converts following format string args to TIMESTAMP:

"yyyy-MM-dd HH:mm:ss"
"yyyy-MM-dd HH:mm:ss Z"
"yyyy-MM-dd HH:mm:ss.SSS"
"yyyy-MM-dd HH:mm:ss.SSS Z"
"yyyy-MM-dd HH:mm:ss.f"
"yyyy-MM-dd HH:mm:ss.f Z"

Returns NULL if argument string evaluates to NULL.

output type
TIMESTAMP

Example

plaintext
FIELDS_ADD(TIMESTAMP("2019-03-14 22:41:55.333 GMT"));

timestamp
2019-03-14 22:41:55.333 +0000

TO_NULL

TO_NULL(expr)

Returns NULL value.

output type
the type of supplied argument

Example

plaintext
FIELDS_ADD(n_i:TO_NULL(i), n_ip:TO_NULL(ip), n_time:TO_NULL(t), n_str:TO_NULL(s));

Result details (double click on resultset):

name	value	type
n_i	NULL	INTEGER
n_ip	NULL	IPADDR
n_time	NULL	TIMESTAMP
n_str	NULL	STRING

TUPLE

TUPLE(expr, …)

Converts one or more expressions returning any data type to TUPLE.

output type
TUPLE

Example

plaintext
FIELDS_ADD(t:TUPLE(1,2.0,"foo")) | FIELDS_ADD(TYPE(t));

t	type
{f_0=1 f_1=2.0 f_2="foo"}	TUPLE

VARIANT

VARIANT(expr)

VAR(expr)

Converts primitive type expr to VARIANT. Returns NULL if expr evaluates to NULL.

output type
VARIANT

Example

plaintext
FIELDS_ADD(var:VARIANT(s));

Result details (double click on resultset row):

name	value	type
var	0ho0	VARIANT<STRING>

VARIANT_ARRAY

VARIANT_ARRAY(arg)

VAR_ARR(arg)

Converts ARRAY or primitive type arg to VARIANT_array

output type
VARIANT_array

Example

plaintext
FIELDS_ADD(res:VARIANT_ARRAY([1,2,3])) | FIELDS_ADD(TYPE(res));

res	type
[1,2,3]	VARIANT_ARRAY

VARIANT_OBJECT

VARIANT_OBJECT(expr)

Converts TUPLE, VARIANT or primitive type expr to VARIANT_OBJECT.

output type
VARIANT_OBJECT

Example

plaintext
FIELDS_ADD(vo_tuple:VARIANT_OBJECT({a:1, b:2})) | FIELDS_ADD(TYPE(vo_tuple));

vo_tuple	type
{"a":1,"b":2}	VARIANT_OBJECT

EMPTY_ARRAY(type)

Creates an empty array of type

NULL_ARRAY(type)

Creates a null array of type

output_type
ARRAY

NULL_TUPLE(type)

Creates a null tuple of type

output_type
TUPLE