On This Page

Home / Stream/ Functions/Eval

Eval ​

The Eval Function adds, modifies, or removes event fields. Eval is optimized for simple, single-value assignments and transformations using JavaScript expressions. For complex logic or multi-step processing, use the Code Function.

Usage ​

Filter: Filter expression (JavaScript) that selects data to feed through the Function. Defaults to true, meaning it evaluates all events.

Description: Simple description about this Function. Defaults to empty.

Final: Toggle on to stop feeding data to the downstream Functions. Default is toggled off.

Evaluate fields: Table of event fields to evaluate and add/set. Select Add Field to add each field as a key-value pair, in a row with the following controls:

  • Name: Enter the new (or modified) field’s name.
  • Value Expression: Enter a JavaScript expression to set the field’s value - this can be a constant. Expressions can contain nested addressing. When you insert JavaScript template literals, strings intended to be used as values must be delimited with single quotes, double quotes, or backticks. For specific constraints, see Value Expression Limitations. For details on fields with non-alphanumeric characters, see Build Custom Logic to Route and Process Your Data: Fields with Non-Alphanumeric Characters.
  • Enabled: Toggle this off to disable evaluating individual expressions, while retaining their configuration in the table. Useful for iterative development and debugging.

Keep fields: List of fields to keep in the event after processing by this Function. Takes precedence over the Remove fields setting. The field accepts wildcards (*), which supports both:

  • Wildcards (*) to include multiple fields.
  • Nested addressing, where you can reference a parent field and all its children using a wildcard. For example, if you convert _raw into an object, use _raw* to refer to _raw and all nested fields inside it. See Wildcard Lists for more information.

Remove fields: List of fields to remove from the event. Supports wildcards (*) and nested addressing. Cannot remove fields that match against the Keep fields list. Cribl Stream internal fields that start with __ (double underscore) cannot be removed via wildcard. Instead, you must specify them individually. For example, __myField cannot be removed by specifying __myF*.

Value Expression Limitations ​

The Value Expression supports simple, single-value assignments and transformations. For advanced logic and complex operations, use the Code Function.

The following limitations apply to expressions:

  1. Reserved Words: Expressions cannot utilize JavaScript reserved words like constructor, prototype, and __proto__.

    Cribl responds with: Error: Expression cannot make use of the reserved word '<word>'.

  2. Setters: The definition or use of JavaScript setters is not allowed within expressions.

    Cribl responds with: Error: Expression cannot use setter.

  3. Assignment Operators: Assignment operators like =, +=, -= are not permitted, except for direct assignment to the configured field. For example, myField = <expression>.

    Cribl responds with: Error: Unallowed assignment operator found in expression.

  4. Nested Scopes: Expressions cannot introduce nested scopes. This includes, but is not limited to:

    • Loops (for, while, do-while)
    • Array iteration methods (.map, .forEach, .reduce, and so on)
    • Control structures (if, switch, try-catch)

    Cribl responds with: Error: Expression cannot have nested scopes.

  5. Internal Expressions: Expressions are prevented from referencing internal Cribl expressions, such as C.internal.

    Cribl responds with: Error: Expression cannot reference 'C.internal'.

  6. Declarations: Variable or function declarations are not allowed. This includes:

    • Variable declarations (let, const, var)
    • Function definitions (function declarations, arrow functions, function expressions)

    Cribl responds with: Error: Expression cannot have any declarations.

Using Keep and Remove ​

A field matching an entry in