Formula Search Field Expression Plugin

The Formula plugin extracts values from a Log Event by combining functions, much like a formula in Microsoft Excel. Use it when a single plugin isn't enough: to extract and then transform a value, to combine values from the body and the context, to count or sum, or to look up a value in a SQL database.

• ✅ Extract from the message body, context properties, and Log Event fields in one expression
• ✅ Nest functions: the result of one function is the content of the next
• ✅ Convert, alter, test, and calculate on the extracted values

Tip

Start with a dedicated plugin such as XPath or JSON Path when it can do the job; see Choose a plugin. Use Formula when you need to combine or transform.

How a Formula Is Evaluated

A formula is evaluated from the inside out. A source function reads data from the Log Event; every other function takes content (the output of the function inside it) and returns new content. The final result becomes the Search Field values.

Diagram: a formula reads a source from the Log Event, extracts values, optionally transforms or tests them, and returns the Search Field values.

Nesting, Step by Step

Input

<Orders>
<Id>3</Id>
<Id>6</Id>
</Orders>

Formula

count(xPath('/Orders/Id', body))

Evaluation

1. body returns the whole message body.
2. xPath('/Orders/Id', body) returns two values: 3 and 6.
3. count(...) counts them.

Result

2

The nested formula returns 2, one value counted per matching Id element.

Formula language rules

These rules apply to every function. Function pages link here instead of repeating them.

Escaping Single Quotes

Input

{"ord'erid":"123","name":"John Doe"}

Formula

jsonPath('ord''erid', body)

Result

123

The key ord'erid is written ord''erid inside the quoted JSONPath expression.

Function reference

Each function has its own page with parameters, return values, and examples.

Source

Read data from the Log Event.

Extract

Pick values out of structured or unstructured content.

Convert

Change the encoding or case of content.

Alter

Change text.

Logical

Test content.

Math

Aggregate values. The optional unique argument is an unquoted true or false: with false, a value that occurs several times counts every time (two invoice lines of 100 → sum = 200); with true, identical values count once (→ 100). Values are compared as text, so 100 and 100.00 are different. The default differs per function, as shown below; leave it false for totals.

Performance

• Every formula runs for every matching Log Event during logging and re-index; keep formulas as short as the job allows.
• Use xPath (XPath 1.0, forward-only reader) for large XML; use xPath2 only when you need XPath 2.0 features.
• sqllookup queries SQL Server for each evaluation; see sqllookup before using it on high-volume Message Types.

Next Steps

• Add or manage Search Field
• Test Your Expression
• Add or manage Log View

Related Topics

• Search Field Expressions
• Choose a plugin
• Search Fields
• Message Types
• Log Event
• Log Views