Help Center/ Log Tank Service/ Best Practices/ Log Jobs (Beta)/ Judging Events Using DSL Processing Functions
Updated on 2025-12-04 GMT+08:00
View PDF
Share

Judging Events Using DSL Processing Functions

Event judgment enables you to perform operations on data that meets specific conditions, making the processing logic more reliable. This section describes the common scenarios and best practices of using DSL functions for event judgment.

Scenario 1: Checking Whether a Field Exists

  • Raw log 
    {
  "a": "a_value"
}
  • Processing rule 
    e_if(e_has("a"),e_set("has_a", true))
e_if(e_has("b"),e_set("has_b", true))
e_if(e_not_has("a"),e_set("not_has_a", true))
e_if(e_not_has("b"),e_set("not_has_b", true))
  • Processing result 
    {
	"a": "a_value",
	"not_has_b": true,
	"has_a": true
}

Scenario 2: Checking Whether a Field Value Exists and Is Not Empty

  • Raw log 
    {
  "a": "a_value",
  "b":""
}
  • Processing rule 
    e_if_else(v("a"), e_set("not_empty_a", true),e_set("not_empty_a", false))
e_if_else(v("b"), e_set("not_empty_b", true),e_set("not_empty_b", false))
  • Processing result 
    {
	"a": "a_value",
	"not_empty_b": false,
	"b": "",
	"not_empty_a": true
}

Scenario 3: Checking Whether a Field Value Exists and Is Empty

  • Raw log 
    {
  "a": "a_value",
  "b":""
}
  • Processing rule 
    e_if_else(op_and(e_has("a"), op_not(v("a"))), e_set("empty_a", true),e_set("empty_a", false))
e_if_else(op_and(e_has("b"), op_not(v("b"))), e_set("empty_b", true),e_set("empty_b", false))
  • Processing result 
    {
	"a": "a_value",
	"b": "",
	"empty_b": true,
	"empty_a": false
}

Scenario 4: Querying and Judging Logic Based on Field Values

  • Raw logs 
    [
{
"http_host": "example.com",
"status": 200,
"request_method": "GET",
"scheme": "https",
"header_length": 700,
"body_length": 1200
},
{
"http_host": "example.org",
"status": 200,
"request_method": "POST",
"scheme": "https",
"header_length": 100,
"body_length": 800
},
{
"http_host": "example.net",
"status": 200,
"request_method": "GET",
"scheme": "http",
"header_length": 200,
"body_length": 800
},
{
"http_host": "example.cn",
"status": 404,
"request_method": "GET",
"scheme": "https",
"header_length": 100,
"body_length": 300
}
]
  • Processing requirement 1: Add a new field type with value normal to all log events where the status value is 200.
    Processing rule 
    e_if(e_match("status", "200"), e_set("type", "normal"))
    Processing result 
    {
	"scheme": "https",
	"header_length": 700,
	"request_method": "GET",
	"type": "normal",
	"http_host": "example.com",
	"status": 200,
	"body_length": 1200
}
{
	"scheme": "https",
	"header_length": 100,
	"request_method": "POST",
	"type": "normal",
	"http_host": "example.org",
	"status": 200,
	"body_length": 800
}
{
	"scheme": "http",
	"header_length": 200,
	"request_method": "GET",
	"type": "normal",
	"http_host": "example.net",
	"status": 200,
	"body_length": 800
}
{
	"scheme": "https",
	"header_length": 100,
	"request_method": "GET",
	"http_host": "example.cn",
	"status": 404,
	"body_length": 300
}
  • Processing requirement 2: Add a new field type with value normal to all log events where all of the following conditions are met: status is 200, request_method is GET, and scheme is https.
    Processing rule 
    e_if(e_match_all("status", "200", "request_method","GET", "scheme", "https"), e_set("type", "normal"))
    Processing result 
    {
	"scheme": "https",
	"header_length": 700,
	"request_method": "GET",
	"type": "normal",
	"http_host": "example.com",
	"status": 200,
	"body_length": 1200
}
{
	"scheme": "https",
	"header_length": 100,
	"request_method": "POST",
	"http_host": "example.org",
	"status": 200,
	"body_length": 800
}
{
	"scheme": "http",
	"header_length": 200,
	"request_method": "GET",
	"http_host": "example.net",
	"status": 200,
	"body_length": 800
}
{
	"scheme": "https",
	"header_length": 100,
	"request_method": "GET",
	"http_host": "example.cn",
	"status": 404,
	"body_length": 300
}
  • Processing requirement 3: Add a new field type with value normal to all log events where any of the following conditions are met: status is 200, request_method is GET, or scheme is https.
    Processing rule 
    e_if(e_match_any("status", "200", "request_method","GET", "scheme", "https"), e_set("type", "normal"))
    Processing result 
    {
	"scheme": "https",
	"header_length": 700,
	"request_method": "GET",
	"type": "normal",
	"http_host": "example.com",
	"status": 200,
	"body_length": 1200
}
{
	"scheme": "https",
	"header_length": 100,
	"request_method": "POST",
	"type": "normal",
	"http_host": "example.org",
	"status": 200,
	"body_length": 800
}
{
	"scheme": "http",
	"header_length": 200,
	"request_method": "GET",
	"type": "normal",
	"http_host": "example.net",
	"status": 200,
	"body_length": 800
}
{
	"scheme": "https",
	"header_length": 100,
	"request_method": "GET",
	"type": "normal",
	"http_host": "example.cn",
	"status": 404,
	"body_length": 300
}
Parent topic: Log Jobs (Beta)