eval
Evaluates the expression on the right and then assigns a new field or replaces the old field value. You can enter any combination of expressions that can be evaluated to value on the right side.
Syntax
eval FIELD=EXPR, ...
Required Parameter
FIELD=EXPR, ...
- Statement to assign the value obtained by evaluating the expression to a new or old field. You can enter any combination of expressions that can be evaluated to value on the right side. Use commas (
,
) as a separators to specify multiple pairs of assignments. If there are multiple pairs ofFIELD=EXPR
, the command evaluates them in order from the left.
Usage
-
Evaluate the int("100") function to convert the string to an integer and then assign it to the num field.
json "{}" | eval num = int("100")
-
Call the typeof() to assign the type of a specific value to the type1, type2 field.
json "{}" | eval type1 = typeof("string"), type2 = typeof(100)
-
Sum up the field values
json "{}" | eval sent = 100, rcvd = 200, total = sent + rcvd
-
Assign the results of executing the `concat("hello", ", world")` function to the msg field
json "{}" | eval msg = concat("hello", ", world")