text

Subcommands

Subcommand	Description	Syntax
`len`	Gets the length of a string in unicode graphemes	`len(<expr>)`
`blen`	Gets the length of a string in bytes	`blen(<expr>)`
`clen`	Gets the length of a string in characters	`clen(<expr>)`
`lower`	Converts all uppercase letters in a string to lowercase	`lower(<expr>)`
`upper`	Converts all lowercase letters in a string to uppercase	`upper(<expr>)`
`trim`	Removes leading and trailing whitespace from a string	`trim(<expr>)`
`lstrip`	Removes all characters matching a pattern from the left side of a string	`lstrip(<expr>, <expr>)`
`rstrip`	Removes all characters matching a pattern from the right side of a string	`rstrip(<expr>, <expr>)`
`strip`	Removes all characters matching a pattern from either side of a string	`strip(<expr>, <expr>)`
`entropy`	Calculates the Shannon entropy of a string	`entropy(<expr>)`
`tokenize`	Splits a string into tokens using whitespace as the default delimiter	`tokenize(<expr>)`
`jsonfield`	Extracts a field from a JSON string using a dot-notation path	`jsonfield(<expr>, <expr>)`
`split`	Splits a string into an array of substrings based on a delimiter	`split(<expr>, <expr>)`
`join`	Joins an array of strings into a single string using a delimiter	`join(<expr>, ...)`
`substr`	Returns a substring of a string based on a start and end index	`substr(<expr>, <expr>, <expr>)`
`replace`	Performs a find and replace on a string	`replace(<expr>, <expr>, <expr>)`

| eval len=len(<expr>)

| eval blen=blen(<expr>)

| eval clen=clen(<expr>)

| eval lower=lower(<expr>)

| eval upper=upper(<expr>)

| eval trimmed=trim(<expr>)

Example removing with a the field foo containing the following value abcFoocba:

| eval stripped=lstrip(foo, "abc")

The result will be Foocba.

Example removing with a the field foo containing the following value abcFoocba:

| eval stripped=rstrip(foo, "abc")

The result will be abcFoo.

Example removing with a the field foo containing the following value abcFoocba:

| eval stripped=strip(foo, "abc")

The result will be Foo.

| eval entropy=entropy(<expr>)

| eval tokens=tokenize(<expr>)

| eval value=jsonfield(<expr>, <path>)

For example splitting up components of an FQDN:

| eval split=split("www.example.com", ".")

This will return a multivalue field with the following values ["www","example","com"].

| eval joined=join(<expression 1>, <expression N..> , <delimiter expression>)

For example extracting foo from foobar:

| eval sub=substr("foobar", 0, 3)

For example replacing foo with bar in the value foobar resulting in barbar:

| eval edited=replace("foobar", "foo", "bar")