This article gives some examples on working with JavaScript. These are used in various places in Cribl solutions such as in filters, working with data, and creating dynamic expressions.

Note that certain JS methods may be more performant than others. Check out this blog for some test results and recommendations, especially when considering which ones to use in pipeline functions and filters. You'll also find more info and links at the bottom of this page.

Testing Out Expressions

You can test out expressions by using the pop-out editor found in several places. For example, in the Pipeline view, the Eval function has one on the 'Value Expression' module (red box):

After clicking it, we can use the top box to test out our expressions:

Let's go through some examples using the following sample log. Note that you can copy and paste this into the "Sample input" window above to test these out.

{ "_raw": "simple log", "server": "app_nginx_01", "role": "webserver", "sentence": "this is a group of Words so we can test some jscript stuff" }

Evaluating with Strings

indexOf - Returns the index of the first occurrence of the specified string. Very performant and can be used for filtering (if the string is NOT found, it evaluates to -1; a filter looking for a positive match could be result > -1) sentence.indexOf('Words') — evaluates to 19

sentence.indexOf('words') — evaluates to -1

startsWith - Check beginning of the field server.Startswith('app') — evaluates to TRUE

endsWith - Check end of the field server.endsWith('_01') — evaluates to TRUE

includes - Find a string anywhere in the field server.includes('nginx') — evaluates to TRUE

Evaluating with Regular Expressions

test - Look for a regular expression in a field and give a boolean result /\sWords\s/.test(sentence) — evaluates to TRUE

match - Look for a regular expression in a field and return the matchin an array sentence.match(/jscript/) — evaluates to an array with a value of "jscript"

Working on Data / Value Expressions / Logical Operators

replace - Replace characters Example usage: replace any spaces with nothing (ie remove them) sentence.replace(/\s/g,"") — evaluates to "thisisagroupofWordssowecantestsomejscriptstuff"

if / else - Conditional statements Example: check for a value for 'server' and output 'yes' or 'no' server=='app_nginx_01' ? 'yes' : 'no'— evaluates to "yes" and / or / not - Logical operators Example: check for two or more conditions with AND server=='app_nginx_01'&& role=='webserver'— evaluates to TRUE Example: check for at least one condition with OR server=='app_nginx_01'|| role=='dbserver'— evaluates to TRUE Example: check for a negative condition with NOT server!='app_nginx_01'— evaluates to FALSE length - Get the character count server.length — evaluates to "12"

Using Variables

Variables can be useful for many purposes, such as constructing dynamic partitioning expressions for writing events to object storage.

Example (note the backticks at the beginning and end): `${server}-${role}`— evaluates to "app_nginx_01-webserver"

Additional Resources

• Cribl Expression Reference
• Cribl University Course on JS Expressions
• JS Developer Reference