These docs are for Cribl Stream 4.14 and are no longer actively maintained.

See the latest version (4.20).

The Code Function is a powerful way to transform events without needing to write a custom function. Using JavaScript methods such as map, reduce, forEach, some, and every is possible.

Cribl still recommends that you use Cribl Stream’s basic, built-in Functions, like Eval, as much as possible. But these use cases demonstrate some basic ways to use the new Code Function to solve questions asked in the Cribl’s Slack Community.

Basic Examples ​

Example Event Data ​

The first several examples below use the following JSON object as a sample event. You can copy and paste this event into Cribl Stream’s Sample Data pane. Add the Do Not Break Ruleset to your Source, select the noBreak1MB Event Breaker, and under your Source’s Advanced Settings, enable Parse JSON Event.

{
  "cpus": [
    {"number": 1, "name": "CPU1", "value": 2.3},
    {"number": 2, "name": "CPU2", "value": 3.1},
    {"number": 3, "name": "CPU3", "value": 5.1},
    {"number": 4, "name": "CPU4", "value": 1.3}
  ],
  "arch": "Intel x64"
}

Accessing Fields in an Event ​

To access a field inside an event, you can use the __e special variable. The __e prefix allows for access to the (context) event inside a JavaScript expression. For example, if you want to access the extracted field field-name, use the following syntax:

__e['field-name']

In other words, think of your code executing in a context like this:

function(__e: Event) {
 // your code here
}

Eval a Field ​

To create a new field, it is as simple as assigning the field to a value. For example, if you want to create a field test with the value Hello, Goats!, use the following syntax:

__e['test'] = 'Hello, Goats!'

JSON Filter ​

To filter the cpus array inside the event, you can use the filter function to keep only certain values, based on a logic condition. In the example below, only entries where the value is greater than or equal to 3 are kept, and placed into a new field called cpus_filtered.

__e['cpus_filtered'] = __e['cpus'].filter(entry => entry.value >= 3)

Reduce ​

The reduce method allows you to summarize data across an array, with a returned accumulator value. In the example below, a new field, cpus_reduce, will be created with a value of 11.8.

__e['cpus_reduce'] = __e['cpus'].reduce((accumulator, entry) => accumulator + entry.value, 0)

Some/Every ​

The some and every methods return a boolean result (true/false).

The some method checks that there is at least one logic validation that returns true. In the example below, cpus_some would be set to true because there is at least one object with a value greater than or equal to 3.

__e['cpus_some'] = __e['cpus'].some(entry => entry.value >= 3)

The every method checks that every entry in the array returns true. If so, the result is true; otherwise, this returns false. In the example below, the value for cpus_every would be false, because not all values in the event are greater than or equal to 10.

__e['cpus_every'] = __e['cpus'].every(entry => entry.value >= 10)

Advanced Examples ​

Transform a Specific Field ​

In this example, each cpus member will have its name field transformed to lowercase. Object.assign is used to keep the original object, while assigning the name field to the desired value.

__e['cpus'] = __e['cpus'].map(entry => Object.assign(entry, {'name': entry.name.toLowerCase()}))