事件判斷
通過(guò)事件判斷可以更好地對(duì)符合特定條件的數(shù)據(jù)進(jìn)行相應(yīng)操作，讓加工邏輯更可靠。本文主要介紹使用函數(shù)進(jìn)行事件判斷的常見(jiàn)場(chǎng)景和最佳方案示例。
場(chǎng)景1：判斷字段是否存在
原始日志
a: a_value b: //空字符串SLS DSL編排
方案一（推薦）：采用
e_has或e_not_has。e_if(e_has("a"),e_set("has_a", true)) e_if(e_has("b"),e_set("has_b", true)) e_if(e_has("c"),e_set("has_c", true)) e_if(e_not_has("a"),e_set("not_has_a", true)) e_if(e_not_has("b"),e_set("not_has_b", true)) e_if(e_not_has("c"),e_set("not_has_c", true))方案二：采用
e_search。e_if(e_search('a: *'),e_set("has_a", true)) e_if(e_search('b: *'), e_set("has_b", true)) e_if(e_search('c: *'), e_set("has_c", true)) e_if(e_search('not a: *'), e_set("not_has_a", true)) e_if(e_search('not b: *'), e_set("not_has_b", true)) e_if(e_search('not c: *'), e_set("not_has_c", true))說(shuō)明加工規(guī)則中的
e_if可通過(guò)e_if(條件1，操作1，條件2，操作2)的形式合并為一項(xiàng)，此處和本文其他處的拆分是為了方便閱讀。
加工結(jié)果
a:a_value b: //空字符串 has_a: true has_b: true not_has_c: true
場(chǎng)景2：判斷字段值是否存在且不為空
原始日志
a: a_value b: // 空字符串SLS DSL編排
方案一（推薦）：采用字段取值函數(shù)
ve_if(v("a"), e_set("not_empty_a", true)) e_if(v("b"), e_set("not_empty_b", true)) e_if(v("c"), e_set("not_empty_c", true))說(shuō)明字段取值函數(shù)
v，當(dāng)對(duì)應(yīng)字段存在且值不為空時(shí)，其自動(dòng)轉(zhuǎn)換的Bool值為true，否則為false。方案二：采用
e_search#至少一個(gè)字符 e_if(e_search('a: "?"'), e_set("not_empty_a", true)) e_if(e_search('b: "?"'), e_set("not_empty_b", true)) e_if(e_search('c: "?"'), e_set("not_empty_c", true)) #正則 e_if(e_search('a~=".+"'), e_set("not_empty_a", true)) e_if(e_search('b~=".+"'), e_set("not_empty_b", true)) e_if(e_search('c~=".+"'), e_set("not_empty_c", true)) #存在且不為空 e_if(e_search('a: * and not a==""'), e_set("not_empty_a", true)) e_if(e_search('b: * and not b==""'), e_set("not_empty_b", true)) e_if(e_search('c: * and not c==""'), e_set("not_empty_b", true))
加工結(jié)果
a: a_value b: //空串 not_empty_a: true
場(chǎng)景3：判斷字段值是否存在且為空
原始日志
a: a_value b: // 空字符串SLS DSL編排
方案一（推薦）：采用字段取值函數(shù)
ve_if(op_and(e_has("a"), op_not(v("a"))), e_set("empty_a", true)) e_if(op_and(e_has("b"), op_not(v("b"))), e_set("empty_b", true)) e_if(op_and(e_has("c"), op_not(v("c"))), e_set("empty_c", true)) # 錯(cuò)誤方案 e_if(op_not(v("a")), e_set("empty_a", true)) e_if(op_not(v("b")), e_set("empty_b", true)) e_if(op_not(v("c")), e_set("empty_c", true))說(shuō)明字段取值函數(shù)
v，當(dāng)對(duì)應(yīng)字段存在且值不為空時(shí)，其自動(dòng)轉(zhuǎn)換的Bool值為true，否則為false。當(dāng)值不存在時(shí)，其返回true，op_not(None)時(shí)也是返回true。方案二：采用
e_searche_if(e_search('a==""'), e_set("empty_a", true)) e_if(e_search('b==""'), e_set("empty_b", true)) e_if(e_search('c==""'), e_set("empty_c", true)) # 錯(cuò)誤調(diào)用 e_if(e_search('a:""'), e_set("empty_a", true)) e_if(e_search('b:""'), e_set("empty_b", true))說(shuō)明以上錯(cuò)誤調(diào)用中，因函數(shù)
e_search為部分查詢(xún)，字段存在時(shí)，無(wú)論其值是否空串，空串a: ""一直為true。
加工結(jié)果
a: a_value b: //空字符串 empty_b: true
場(chǎng)景4：基于字段值的邏輯查詢(xún)判斷
原始日志
"日志1" http_host: example.com status: 200 request_method: GET scheme: https header_length: 700 body_length: 1200 "日志2" http_host: example.org status: 200 request_method: POST scheme: https header_length: 100 body_length: 800 "日志3" http_host: example.net status: 200 request_method: GET scheme: http header_length: 700 body_length: 800 "日志4" http_host: aliyundoc.com status: 404 request_method: GET scheme: https header_length: 100 body_length: 300加工需求1
為所有
status字段值為200的日志事件，添加一個(gè)新字段type，其值為normal。SLS DSL編排
e_if(e_match("status", "200"), e_set("type", "normal")) 或 e_if(e_search('status==200'), e_set("type", "normal"))說(shuō)明簡(jiǎn)單場(chǎng)景下，以上兩種編排均可。
本文情況下可采用
status:200，表示status是否包含200，但推薦使用status==200更精確。
加工結(jié)果
"日志1" type: normal http_host: example.com status: 200 request_method: GET scheme: https header_length: 700 body_length: 1200 "日志2" type: normal http_host: example.org status: 200 request_method: POST scheme: https header_length: 100 body_length: 800 "日志3" type: normal http_host: example.net status: 200 request_method: GET scheme: http header_length: 700 body_length: 800 "日志4" http_host: aliyundoc.com status: 404 request_method: GET scheme: https header_length: 100 body_length: 300
加工需求2
為所有
status字段值為200，且request_method字段值為GET，且scheme字段值為https的日志事件添加一個(gè)新字段type，其值為normal。SLS DSL編排
e_if(e_search('status==200 and request_method==GET and scheme==https'), e_set("type", "normal")) 或 e_if(e_match_all("status", "200", "request_method", "GET", "scheme", "https"), e_set("type", "normal"))說(shuō)明需要同時(shí)滿(mǎn)足多個(gè)字段的匹配條件的應(yīng)用場(chǎng)景中，您可采用
e_search或e_match_all，e_search用法相對(duì)簡(jiǎn)潔。本文情況可以采用
status: 200，表示status是否包含200，但推薦使用status==200更精確。
加工結(jié)果
"日志1" type: normal http_host: example.com status: 200 request_method: GET scheme: https header_length: 700 body_length: 1200 "日志2" http_host: example.org status: 200 request_method: POST scheme: https header_length: 100 body_length: 800 "日志3" http_host: example.net status: 200 request_method: GET scheme: http header_length: 700 body_length: 800 "日志4" http_host: aliyundoc.com status: 404 request_method: GET scheme: https header_length: 100 body_length: 300
加工需求3
為所有
status字段值為200，或request_method字段值為GET，或scheme字段值為https的日志事件添加一個(gè)字段type，其值為normal。SLS DSL編排
e_if(e_search('status==200 or request_method==GET or scheme==https'), e_set("type", "normal")) 或者 e_if(e_match_any("status", "200", "request_method", "GET", "scheme", "https"), e_set("type", "normal"))加工結(jié)果
"日志1" type: normal http_host: example.com status: 200 request_method: GET scheme: https header_length: 700 body_length: 100 "日志2" type: normal http_host: example.org status: 200 request_method: POST scheme: https header_length: 100 body_length: 800 "日志3" type: normal http_host: example.net status: 200 request_method: GET scheme: http header_length: 700 body_length: 800 "日志4" type: normal http_host: aliyundoc.com status: 404 request_method: GET scheme: https header_length: 100 body_length: 1300
加工需求4
為所有
status字段值為200，且request_method字段值為GET，且header_length，且body_length的字段值之和小于等于1000的日志事件，添加一個(gè)新字段type，其值為normal。SLS DSL編排
e_if(op_and(e_search('status: 200 and request_method: GET'), op_le(op_sum(v("header_length"), v("body_length")), 1000)), e_set("type", "normal"))說(shuō)明在復(fù)雜的邏輯場(chǎng)景下，您可采用
e_search和其他表達(dá)式函數(shù)的組合完成SLS DSL編排。加工結(jié)果
"日志1" type: normal http_host: example.com status: 200 request_method: GET scheme: https header_length: 700 body_length: 100 "日志2" http_host: example.org status: 200 request_method: POST scheme: https header_length: 100 body_length: 800 "日志3" http_host: example.net status: 200 request_method: GET scheme: http header_length: 700 body_length: 800 "日志4" http_host: aliyundoc.com status: 404 request_method: GET scheme: https header_length: 100 body_length: 1300