text

Len

The len subcommand is used to get the length of a string in bytes. This means that for utf-8 encoded strings containin non-ascii characters, the result may not be what you expect.

| eval len=len(<expression>)

Lower

The lower subcommand converts all uppercase letters in a string to lowercase.

| eval lower=lower(<expression>)

Upper

The upper subcommand converts all lowercase letters in a string to uppercase.

| eval upper=upper(<expression>)

Trim

The trim subcommand removes leading and trailing whitespace from a string.

| eval trimmed=trim(<expression>)

Concatenate

The concatenate subcommand concatenates two or more strings into one, you can optionally specify a delimiter to be inserted between the strings with the sep="val" argument.

| eval abc=concat("a", "b" , "c")
| eval a_b=concat("a", "b" , sep="_")

LStrip

The lstrip subcommand removes all characters matching a pattern from the left side of a string until it encounters a character not in the pattern.

NOTE: The order of the characers in the pattern does not matter, only that they are present in the string.

| eval stripped=lstrip(<value expression>, <pattern expression>)

Example removing with a the field foo containing the following value abcFoocba

| eval stripped=lstrip(foo, "abc")

The result will be Foocba.

RStrip

The rstrip subcommand removes all characters matching a pattern from the right side of a string until it encounters a character not in the pattern.

NOTE: The order of the characers in the pattern does not matter, only that they are present in the string.

| eval stripped=rstrip(<value expression>, <pattern expression>)

Example removing with a the field foo containing the following value abcFoocba

| eval stripped=rstrip(foo, "abc")

The result will be abcFoo.

Strip

The strip subcommand removes all characters matching a pattern from the either side of a string until it encounters a character not in the pattern.

NOTE: The order of the characers in the pattern does not matter, only that they are present in the string.

| eval stripped=strip(<value expression>, <pattern expression>)

Example removing with a the field foo containing the following value abcFoocba

| eval stripped=strip(foo, "abc")

The result will be Foo.

Split

The split subcommand will split a string into an array of substrings based on a delimiter.

| eval split=split(<value expression>, <delimiter expression>)

For example splitting up components of an FQDN:

| eval split=split("www.google.com", ".")

This will return a multivalue field with the following values ["www","google","com"].

SubStr

The substr subcommand returns a substring of a string based on a start and end index.

| eval sub=substr(<value expression>, <start index>, <end index>)

For example extracting foo from foobar:

| eval sub=substr("foobar", 0, 3)

Replace

The replace subcommand performs a find and replace on a string.

| eval edited=replace(<value expression>, <find expression>, <replace expression>)

For example replacing foo with bar in the value foobar resulting in barbar:

| eval edited=replace("foobar", "foo", "bar")