Value Expressions

So far, we've covered using JavaScript expressions in filter expressions; extremely powerful for narrowing down the data you want to work on. But what about transforming that data? A number of the Functions in the Stream product allow you to use "value expressions" to programmatically change or create data. Value Expressions are used in Functions to assign a value to a field.

Let's say, for example, you have events that include a fully qualified domain name (FQDN) as a host field, but you want to be able to do analytics on the domain without the hostname. You could use an Eval Function within your pipeline, to create a field called domain. If you wanted everything but the hostname, you could do an expression such as this:

host.substr(host.indexOf('.')+1)

This expression first finds the first occurrence of the character . in the field, and then returns a substring from the next character to the end of the field. So if the value is server123.us-west-2.myhost.com, the resulting value would be us-west-2.myhost.com

note

In value expressions, it's important to avoid blind operations on invalid source variables. When you're creating value expressions, integrate existence checking into your expression. For example, if you're trying to create a field containing the length measurement of another field (like name.length), you can write it more safely like this: (name || '').length. This syntax will check if the value exists, and if it doesn't, will swap in an empty string, yielding a result of 0.

Now let's try out some examples of value expressions.