Help Center/ Log Tank Service/ Best Practices/ Log Jobs (Beta)/ Enriching Data/ Using the e_dict_map and e_search_dict_map Functions to Enrich Data
Updated on 2025-12-04 GMT+08:00
View PDF
Share

Using the e_dict_map and e_search_dict_map Functions to Enrich Data

This section describes how to use the mapping enrichment functions e_dict_map and e_search_dict_map to enrich data.

Introduction

The data processing mapping enrichment functions of LTS include common mapping functions and search mapping functions. The differences between them are as follows:

  • Common mapping functions use the text full match mode for mapping. Common mapping functions include the e_dict_map and e_table_map functions. The difference between the two is that the e_dict_map function accepts dictionary data, whereas the e_table_map function accepts table data, typically obtained through resource functions.

    For example, you can use the e_dict_map function to convert a specific status code in an Nginx log to the text format.

    Status Code

    Text

    200

    Success

    300

    Redirection

    400

    Request error

    500

    Server error
  • The mapping keyword of the search mapping function is the query string, which supports regular expression matching, full match, and fuzzy match. The search mapping functions include the e_search_dict_map and e_search_table_map functions. The difference between the two is that the e_search_dict_map function accepts dictionary data, whereas the e_search_table_map function accepts table data, typically obtained through resource functions.

    For example, you can use the e_search_dict_map function to convert status codes in a certain range in Nginx logs into text format.

    Status Code

    Text

    2XX

    Success

    3XX

    Redirection

    4XX

    Request error

    5XX

    Server error

Using the e_dict_map Function to Enrich Data

This section describes how to use the e_dict_map function to enrich data.

  • Raw logs 
    [{
    "http_host":  "example.com",
    "http_status":  300,
    "request_method":  "GET"
},
{
    "http_host":  "example.org",
    "http_status":  200,
    "request_method":  "POST"
},
{
    "http_host":  "example.net",
    "http_status":  400,
    "request_method":  "GET"
},
{
    "http_host":  "huaweicloud.com",
    "http_status":  500,
    "request_method":  "GET"
}]
  • Processing requirements

    Convert the request status codes in the http_status field to their corresponding text descriptions and add them to the status_desc field.

  • Processing rule 
    e_dict_map({"400": "Request error", "500": "Server error", "300": "Redirect", "200": "Success"}, "http_status", "status_desc")

    In actual situations, there are more than four HTTP request status codes. For details, see HTTP Status Codes. When the value of http_status is 401 or 404, the dictionary needs to be updated to overwrite the value. Otherwise, the value cannot be matched.

  • Processing result 
    {
	"status_desc": "Redirect",
	"http_status": 300,
	"request_method": "GET",
	"http_host": "example.com"
}
{
	"status_desc": "Success",
	"http_status": 200,
	"request_method": "POST",
	"http_host": "example.org"
}
{
	"status_desc": "Request error",
	"http_status": 400,
	"request_method": "GET",
	"http_host": "example.net"
}
{
	"status_desc": "Server error",
	"http_status": 500,
	"request_method": "GET",
	"http_host": "huaweicloud.com"
}

Using the e_search_dict_map Function to Enrich Data

This case describes how to use the e_search_dict_map function to enrich data.

  • Raw logs 
    [{
    "http_host":  "example.com",
    "http_status":  200,
    "request_method":  "GET"
},
{
    "http_host":  "example.org",
    "http_status":  201,
    "request_method":  "POST"
},
{
    "http_host":  "example.net",
    "http_status":  404,
    "request_method":  "GET"
}]
  • Processing requirements

    Add different type information to each log based on the value of the http_status field in the log.

    • For logs whose http_status is 2XX, add the type field and set its value to Normal.
    • For logs whose http_status is 3XX, add the type field and set its value to Redirect.
    • For logs whose http_status is 4XX, add the type field and set its value to Error.
  • Processing rule 
    e_search_dict_map ({"http_status:2??": "Normal","http_status:3??": "Redirect","http_status:4??": "Error"}, "http_status", "type")
  • Processing result 
    {
	"http_status": "Normal",
	"request_method": "GET",
	"http_host": "example.com"
}
{
	"http_status": "Normal",
	"request_method": "POST",
	"http_host": "example.org"
}
{
	"http_status": "Error",
	"request_method": "GET",
	"http_host": "example.net"
}
Parent topic: Enriching Data