Formula
You hide it, we find it! Learn how to extract and modify returned values from any data structure.
The Nodinite Formula plugin helps you extract any value from any given message by applying one or more (nested) functions. The Nodinite formula plugin, works much like formulas in Microsoft Excel (with the functions listed in the reference table below)
The Formula plugin supports many powerful functions, (Multilevel Nested Functions) which is the key feature of this Search Field expressions plugin. However, it is too early to consider it right away. We will demonstrate this as we move further with the examples (Test Expressions).
- Expression Types are used in Search Fields.
- How to Manage Search Field Expression.
- How to Add or manage Search Field.
Where do the extracted values come from?
The extracted values come from the Body and/or Context that was logged by the Nodinite Logging Agents or from custom logged Log Events.
The documentation for the Formula plugin uses the notion of Content meaning either the Body (actual payload), Context or Result from previous Formula operation.
Content
The operations execute on data that comes from any of the following:
-
- Flatfile and CSV structures
- JSON
- XML
-
- Key/Value
Field New 6.1
- Any of the pre-defined fields (case-sensitive)
The result from a previous Formula operation
The Formula Plugin has different types of functions for example math, string, logical, base64, and these can be nested like:
function(content)function(expression, content)function(1st expression, 2nd expression, content)function(1st expression, 2nd exp.., 3rd.., ..., content)function(content, ..., content)
Sources
| Function | Description |
|---|---|
| body | Returns the whole Body part as a string from the payload of the logged event |
| context('Key Name1') | Returns the value of the specified name from the collection of Context Values of the logged event |
| context(regex('Key Name.*')) | Returns the values of the Regular Expression matching names from the collection of Context Values of the logged event |
| contextKey(regex('Key Name.*')) | Returns the keys of the Regular Expression matching names from the collection of Context Keys of the logged event |
| field | Return the value for the named field' |
Extract
| Function | Description |
|---|---|
| csv(headerRowsToSkip, 'delimiter', columnIndex, 'commentSymbol', content) | Extract data from any valid CSV file |
| jsonPath('expression', content) | Used to extract value for the given path from a JSON valid structure |
| jsonPathKey('expression', content) | Used to extract keys for the given path from a JSON valid structure |
| regex('expression', content) | Use Regular Expression as it is implemented everywhere to extract values |
| regexGroup('expression', 'groups', content) | Use Regular Expression and get the value from selected groups as it is implemented everywhere to extract values |
| xPath('expression', content) | Retrieve values from XML body using a fast forward only reader XPath 1.0 |
| xPath2('expression', content) | Retrieve values from XML body using a XPath 2.0 (high memory usage) |
Convert
| Function | Description |
|---|---|
| base64decode(content [, 'source encoding']) | Decode the provided data into a human-readable format |
| base64encode(content [,'input encoding']) | Encode text to base64 |
| convert('source encoding','target encoding',content) | Convert encoding from source encoding to target encoding New 5.4 |
| toLowerCase(content) | Convert any given text to 'lower case' |
| toUpperCase(content) | Convert any given text to 'UPPER CASE' |
Alter
| Function | Description |
|---|---|
| concat(content, ..., content) | Can be used as a source, or concatenate any number of parameters |
| replace('oldValue', 'newValue',Content) | Used to replace old text/letter with a new text. |
| substring(startIndex0, length, content) | Extract specific text from any given statement/text |
| removebom(content | Remove the BOM if it exists New 5.4 |
Logical
| Function | Description |
|---|---|
| equal('expression', content) | Check the equality of two given texts |
| endsWith('expression', content) | Check if text ends with certain word/letter |
| isnull('expression', content) | Check if value is null, if so return a default value, otherwise return the valueNew 6.1 |
| notEqual('expression', content) | Check the inequality of two given texts |
| startsWith('expression', content) | Check if text starts with certain word/letter |
Math Functions
| Function | Description |
|---|---|
| count(Content, [bool unique = false]) | Return the count of the extracted values, based on the result of any previous operation |
| sum(Content, [bool unique = true]) | Return the sum of the extracted values, based on the result of any previous operation |
| length(content, [bool unique = true]) | Returns the numerical value(s) with the Length of the content |
| min(content, [bool unique = true]) | Return the minimum value of numerical values, returns nothing if no numerical values was found |
| max(content, [bool unique = true]) | Return the maximum value of numerical values, returns nothing if no numerical values was found |
| avg(content, [bool unique = true]) | Return the average value of numerical values, returns nothing if no numerical values was found New 5.5 |
Single quotes
If your expression includes single quotes (apostrophe), you need to escape them using an extra single quote.
| From | To |
|---|---|
' |
'' |
Here's an example of escaping single quotes.
Next Step
How to Add or manage Search Fields
How to Add or manage Log Views
Related
Expression Type Plugins are used in Search Fields.
What are Search Fields?
What are Search Field Expressions?
What are Message Types?
What are Log Views?