- 2 minutes to read
Formula - Field
The field Formula function returns the value of a named field of the Log Event, such as MessageGUID or EventId.
Syntax
field('fieldName')
Parameters
| Parameter | Required | Description |
|---|---|---|
'fieldName' |
Yes | The name of the Log Event field, in single quotes, written exactly as in the table below (case-sensitive). |
Supported Field Names
These are the fields the Field Values tab of the test bench shows (see Test Your Expression). They come from the details part of the Log Event; see JSON Log Event - Details for how each one is set when you log.
| Name | Description |
|---|---|
| ApplicationInterchangeId | Id for the application scope |
| EndPointDirection | The Endpoint Direction |
| EventDirection | The Event Direction |
| EventId | Id of the event (GUID) |
| LocalInterchangeId | Id for the local scope |
| LogDateTime | The originating date and time of the Log Event |
| MessageGUID | Id of the main body part (GUID) |
| OriginalMessageTypeName | The name of the Message Type |
| TotalSize | Size in bytes |
Returns
The value of the named field as text, one value per Log Event.
Examples
Example 1: Read the MessageGUID
Input
| Key | Value |
|---|---|
| EventId | 77dcae21-8c28-ed11-8b59-00155d00b90d |
| LogDateTime | 2022-08-30T19:47:09.3663111+02:00 |
| MessageGUID | ca8e3ab5-7359-4726-a9ca-1f594a4190a1 |
Formula
field('MessageGUID')
Result
ca8e3ab5-7359-4726-a9ca-1f594a4190a1
The value of the MessageGUID row in the Field Values tab is returned as the single match. The Search Field Wizard Test step shows the same tabs as the Search Field editor.
Example 2: Read the EventId
Input
The Field Values of the same Log Event:
The Field Values tab lists every field name you can pass to field, with the values of the test Log Event.
Formula
field('EventId')
Result
77dcae21-8c28-ed11-8b59-00155d00b90d
Notes
fieldreads the fixed Log Event fields only. Use context for Message Context properties and body for the payload.- Nest
fieldin other functions like any other content, for examplesubstring(0, 10, field('LogDateTime'))to keep the date part.