Scenario 6: Determining Logs and Adding Fields Using the e_if or e_switch Function

You are advised to use the e_if or e_switch function to determine logs. For details, see Process Control Functions.

• e_if function

  e_if(condition 1, operation 1, condition 2, operation 2, condition 3, operation 3, ...)

• e_switch function

  The e_switch function evaluates condition-operation pairs sequentially. It checks logs based on conditions in sequence. If a condition is met, the corresponding operation is performed. If a condition is not met, the corresponding operation is not performed and the next condition is checked. If no condition is met and the default parameter is configured, the operation configured for the default parameter is performed and the result is returned.

  e_switch(condition 1, operation 1, condition 2, operation 2, condition 3, operation 3, ..., default=None)

Example:

• Raw log

  {
      "status1":200,
      "status2":404
  }

• e_if function
  • Processing rule

    e_if(e_match("status1", "200"), e_set("status1_info", "normal"),
         e_match("status2", "404"), e_set("status2_info", "error"))

  • Processing result

    {
    	"status1": 200,
    	"status2_info": "error",
    	"status1_info": "normal",
    	"status2": 404
    }

• e_switch function
  • Processing rule

    e_switch(e_match("status1", "200"), e_set("status1_info", "normal"), 
             e_match("status2", "404"), e_set("status2_info", "error"))

  • Processing result: If a condition is met, the result is returned, and the subsequent conditions are not checked.

    {
    	"status1": 200,
    	"status2_info": "error",
    	"status1_info": "normal",
    	"status2": 404
    }