eval

Evaluates the expression on the right and then assigns a new field or replaces the old field value. You can enter any combination of expressions that can be evaluated to value on the right side.

Syntax

eval FIELD=EXPR, ...
Required Parameter
FIELD=EXPR, ...
Statement to assign the value obtained by evaluating the expression to a new or old field. You can enter any combination of expressions that can be evaluated to value on the right side. Use commas (,) as a separators to specify multiple pairs of assignments. If there are multiple pairs of FIELD=EXPR, the command evaluates them in order from the left.

Usage

  1. Evaluate the int("100") function to convert the string to an integer and then assign it to the num field.

    json "{}" | eval num = int("100")
    
  2. Call the typeof() to assign the type of a specific value to the type1, type2 field.

    json "{}" | eval type1 = typeof("string"), type2 = typeof(100)
    
  3. Sum up the field values

    json "{}" |  eval sent = 100, rcvd = 200, total = sent + rcvd
    
  4. Assign the results of executing the `concat("hello", ", world")` function to the msg field

    json "{}" | eval msg = concat("hello", ", world")