Log processing functions - Casting
BOOLEAN
BOOLEAN(string)
Returns TRUE on following string values:
T, t, Y, y, 1, YES, yes, TRUE, true
.
Returns NULL if string argument evaluates to NULL.
Returns FALSE on any other string value.
output type
BOOLEAN
Example:
FIELDS_ADD(bval:BOOLEAN('T'));
bval |
---|
true |
BOOLEAN(numeric_expr)
numeric_expr value 0 is converted to false, other values to true.
Returns NULL if numeric_expr evaluates to NULL.
output type
BOOLEAN
Example:
FIELDS_ADD(bval:BOOLEAN(i));
bval |
---|
false |
true |
true |
BYTES
BYTES(string)
Converts string argument to BYTES
. Returns NULL if string evaluates to NULL.
output type
BYTES
Example:
FIELDS_ADD(b:BYTES('01'));
b |
---|
[48,49] |
BYTES(numeric_array)
Converts numeric_array values to BYTES
. Returns NULL if numeric_array evaluates to NULL.
output type
BYTES
Example:
FIELDS_ADD(b:BYTES([1023,1024,1]));
b |
---|
[-1,0,1] |
DOUBLE
DOUBLE(numeric_expr)
Converts numeric_expr to DOUBLE
. Returns NULL if numeric_expr evaluates to NULL.
output type
DOUBLE
Example
FIELDS_ADD(d:DOUBLE(2 * 300));
d |
---|
600.0 |
DOUBLE(string)
Converts string argument to DOUBLE
. Returns NULL if string evaluates to NULL.
output type
DOUBLE
Example
FIELDS_ADD(d:DOUBLE("-4"));
d |
---|
-4.0 |
DURATION
DURATION(nanoseconds)
Converts numeric nanoseconds value to DURATION
. Returns NULL if nanoseconds evaluates to NULL.
output type
DURATION
Example
FIELDS_ADD(DURATION(1000*60*60*24*30*1000000));
duration |
---|
30 days, 00:00:00.000 |
INTEGER
INTEGER, INT(numeric_expr)
Converts numeric_expr to INTEGER
. Returns NULL if numeric_expr evaluates to NULL.
output type
INTEGER
Example
FIELDS_ADD(i:INT(2.498));
i |
---|
2 |
INTEGER, INT(string)
Converts string argument to INTEGER
. Returns NULL if string evaluates to NULL.
output type
INTEGER
Example
FIELDS_ADD(i:INT("-4"));
i |
---|
-4 |
INTEGER, INT(timestamp)
Converts timestamp argument to INTEGER
. Returns NULL if timestamp evaluates to NULL.
output type
INTEGER
Example
FIELDS_ADD(i:INT(TIMESTAMP("2019-03-14 22:41:55.000 +0000")));
i |
---|
1552603315 |
IPADDR
IPADDR(numeric_expr), IPV4(numeric_expr)
Converts numeric_expr arg to IPADDR
. Returns NULL if numeric_expr evaluates to NULL.
output type
IPADDR
Example
FIELDS_ADD(ip:IPADDR(-1062731520));
ip |
---|
192.168.1.0 |
IPADDR(hi_64_bit_num, low_64_bit_num), IPV6(IPADDR(hi_64_bit_num, low_64_bit_num))
Converts 128-bit numeric argument to IPADDR
. Returns NULL if arguments evaluate to NULL.
output type
IPADDR
Example
FIELDS_ADD(ip:IPADDR(1,1));
ip |
---|
::1:0:0:0:1 |
IPADDR(string), IPV4(string), IPV6(string)
Converts string arg to IPADDR
. Returns NULL if string evaluates to NULL.
output type
IPADDR
Example
FIELDS_ADD(ip:IPADDR("192.168.1.0"));
ip |
---|
192.168.1.0 |
LONG
LONG(numeric_expr)
Converts numeric_expr to LONG
. Returns NULL if numeric_expr evaluates to NULL.
output type
LONG
Example
FIELDS_ADD(l:LONG(2.498));
l |
---|
2 |
LONG(string)
Converts string argument to LONG
. Returns NULL if string evaluates to NULL.
output type
LONG
Example
FIELDS_ADD(l:LONG("-4"));
l |
---|
-4 |
STRING
STRING(expr)
Converts expr returning any type to STRING
. Returns NULL if expr evaluates to NULL.
output type
STRING
Example
FIELDS_ADD(int_str:STRING(i), double_str:STRING(d), ip_str:STRING(ip));
int_str | double_str | ip_str |
---|---|---|
0 | 0.0 | 0.0.0.0 |
1 | 1.0 | 0.0.0.1 |
2 | 2.0 | 0.0.0.2 |
TIMESTAMP
TIMESTAMP(integer), T(integer)
Converts integer seconds elapsed from Unix epoch to TIMESTAMP
.
Returns NULL if integer evaluates to NULL.
output type
TIMESTAMP
Example
FIELDS_ADD(TIMESTAMP(1552603315));
timestamp |
---|
2019-03-14 22:41:55.333000000 +0000 |
TIMESTAMP(long), T(long)
Converts long milliseconds elapsed from Unix epoch to TIMESTAMP
.
Returns NULL if long evaluates to NULL.
output type
TIMESTAMP
Example
FIELDS_ADD(T(1552603315l*1000+333));
timestamp |
---|
2019-03-14 22:41:55.333000000 +0000 |
TIMESTAMP(year, month, day), T(year, month, day)
Converts date specified by integer arguments to TIMESTAMP
. Returns NULL if arguments evaluate to NULL.
output type
TIMESTAMP
Example
FIELDS_ADD(TIMESTAMP(2019,03,14));
timestamp |
---|
2019-03-14 00:00:00.000000000 +0000 |
TIMESTAMP(year, month, day, hour), T(year, month, day, hour)
Converts date and time specified by integer arguments to TIMESTAMP
. Returns NULL if arguments evaluate to NULL.
output type
TIMESTAMP
Example
FIELDS_ADD(TIMESTAMP(2019,03,14,22));
timestamp |
---|
2019-03-14 22:00:00.000000000 +0000 |
TIMESTAMP(year, month, day, hour, minutes), T(year, month, day, hour, minutes)
Converts date and time specified by integer arguments to TIMESTAMP
. Returns NULL if arguments evaluate to NULL.
output type
TIMESTAMP
Example
FIELDS_ADD(TIMESTAMP(2019,03,14,22,41));
timestamp |
---|
2019-03-14 22:41:00.000000000 +0000 |
TIMESTAMP(year, month, day, hour, minutes, seconds), T(year, month, day, hour, minutes, seconds)
Converts date and time specified by integer arguments to TIMESTAMP
. Returns NULL if arguments evaluate to NULL.
output type
TIMESTAMP
Example
FIELDS_ADD(TIMESTAMP(2019,03,14,22,41,55));
timestamp |
---|
2019-03-14 22:41:55.000000000 +0000 |
TIMESTAMP(year, month, day, hour, minutes, seconds, milliseconds)
T(year, month, day, hour, minutes, seconds, milliseconds)
Converts date and time specified by integer arguments to TIMESTAMP
. Returns NULL if arguments evaluate to NULL.
output type
TIMESTAMP
Example
FIELDS_ADD(TIMESTAMP(2019,03,14,22,41,55,333));
timestamp |
---|
2019-03-14 22:41:55.333000000 +0000 |
TIMESTAMP(string), T(string)
Converts following format string args to TIMESTAMP
:
- "yyyy-MM-dd HH:mm:ss"
- "yyyy-MM-dd HH:mm:ss Z"
- "yyyy-MM-dd HH:mm:ss.SSS"
- "yyyy-MM-dd HH:mm:ss.SSS Z"
- "yyyy-MM-dd HH:mm:ss.f"
- "yyyy-MM-dd HH:mm:ss.f Z"
Returns NULL if argument string evaluates to NULL.
output type
TIMESTAMP
Example
FIELDS_ADD(TIMESTAMP("2019-03-14 22:41:55.333 GMT"));
timestamp |
---|
2019-03-14 22:41:55.333 +0000 |
TO_NULL
TO_NULL(expr)
Returns NULL value.
output type
the type of supplied argument
Example
FIELDS_ADD(n_i:TO_NULL(i), n_ip:TO_NULL(ip), n_time:TO_NULL(t), n_str:TO_NULL(s));
Result details (double click on resultset):
name | value | type |
---|---|---|
n_i | NULL | INTEGER |
n_ip | NULL | IPADDR |
n_time | NULL | TIMESTAMP |
n_str | NULL | STRING |
TUPLE
TUPLE(expr, …)
Converts one or more expressions returning any data type to TUPLE
.
output type
TUPLE
Example
FIELDS_ADD(t:TUPLE(1,2.0,"foo")) | FIELDS_ADD(TYPE(t));
t | type |
---|---|
{f_0=1 f_1=2.0 f_2="foo"} | TUPLE |
VARIANT
VARIANT(expr)
VAR(expr)
Converts primitive type expr to VARIANT
. Returns NULL if expr evaluates to NULL.
output type
VARIANT
Example
FIELDS_ADD(var:VARIANT(s));
Result details (double click on resultset row):
name | value | type |
---|---|---|
var | 0ho0 | VARIANT<STRING> |
VARIANT_ARRAY
VARIANT_ARRAY(arg)
VAR_ARR(arg)
Converts ARRAY
or primitive type arg to VARIANT_array
output type
VARIANT_array
Example
FIELDS_ADD(res:VARIANT_ARRAY([1,2,3])) | FIELDS_ADD(TYPE(res));
res | type |
---|---|
[1,2,3] | VARIANT_ARRAY |
VARIANT_OBJECT
VARIANT_OBJECT(expr)
Converts TUPLE
, VARIANT
or primitive type expr to VARIANT_OBJECT
.
output type
VARIANT_OBJECT
Example
FIELDS_ADD(vo_tuple:VARIANT_OBJECT({a:1, b:2})) | FIELDS_ADD(TYPE(vo_tuple));
vo_tuple | type |
---|---|
{"a":1,"b":2} | VARIANT_OBJECT |
EMPTY_ARRAY(type)
Creates an empty array of type
NULL_ARRAY(type)
Creates a null array of type
output_type
ARRAY
NULL_TUPLE(type)
Creates a null tuple of type
output_type
TUPLE