Filter

Keep events that pass a Boolean function. This function only takes scalar functions that output Boolean.

Function Input

collection<record<R>>

This function takes in collections of records with schema R.

Function Output

collection<record<R>>

This function outputs collections of records with schema R.

Arguments

Argument	Input	Description	UI example
predicate	expression<boolean>	A boolean expression, where the expression returns either true or false.	not(eq(map-get(get("attributes"),"0"), "true"));

DSL examples

1. Filter for events that occur past a specific timestamp:

gt(get("timestamp"), 1546329600L);

2. Filters out events that are null in the _value field:

not(eq(get("_value"), null));

3. Filters for events with vmstat sourcetype:

eq(get("source_type"), "vmstat");

4. Filters for events with either syslog sourcetype or vmstat sourcetypes:

or(
    eq(get("source_type"), "syslog"),
    eq(get("source_type"), "vmstat")
);

5. Use the like comparison operator similar to a wildcard: Returns only records where the source_type field begins with "cisco".

like(get("source_type"), "cisco%");