Functions by Category
  • 17 Aug 2022
  • 6 Minutes to read
  • Dark
    Light

Functions by Category

  • Dark
    Light

The following lists describe built-in Graylog functions by category. The lists are in alphabetical order.

Boolean

Boolean data is primarily associated with conditional statements, which allow different actions by changing control flow depending on whether a condition evaluates to true or false. Boolean functions determine Boolean values or operators.

Function Description
grok_exists Checks if the given Grok pattern exists.
is_boolean Checks whether a value is a boolean value (true or false).
is_collection Checks whether a value is an iterable collection.
is_date Checks whether a value is a date (of type DateTime).
is_double Checks whether a value is a floating point value (of type double).
is_ip Checks whether a value is an IP address (IPv4 or IPv6).
is_json Checks whether a value is a parsed JSON tree.
is_list Checks whether a value is an iterable list.
is_long Checks whether a value is an integer value (of type long).
is_map Checks whether a value is a map.
is_not_null Checks whether a value is not null.
is_null Checks whether a value is null.
is_number Checks whether a value is a numeric value (of type long or double).
is_period Checks whether a value is a time period (of type Period).
is_string Checks whether a value is a string.
is_url Checks whether a value is a parsed URL.
key_value Extracts key/value pairs from a string.
lookup_string_list_contains Looks up a value in the string list referenced by the key in the named lookup table.

Boolean/Message Function

Function Description
cidr_match Checks whether the given IP matches a CIDR pattern.
has_field Checks whether the currently processed message contains the named field.

Conversion

These are used to convert a value from one format to another.

Function Description
expand_syslog_priority Converts a syslog priority number to its level and facility.
expand_syslog_priority_as_string Converts a syslog priority number to its level and facility string representations.
syslog_facility Converts a syslog facility number to its string representation.
syslog_level Converts a syslog level number to its string representation.
to_bool Converts the single parameter to a boolean value using its string value.
to_date Converts a type to a date.
to_double Converts the first parameter to a double floating point value.
to_ip Converts the given string to an IP object.
to_long Converts the first parameter to a long integer value.
to_map Converts a value to a map.
to_string Converts the first parameter to its string representation.
to_url Converts a value to a valid URL using its string representation.

Date/Time

A DateTime function performs an action or calculation on a date and time value.

Function Description
days Create a period with a specified number of days.
flex_parse_date Attempts to parse a date and time using the Natty date parser.
format_date Formats a date and time according to a given formatter pattern.
millis Can return either the Unix epoch value or the duration in milliseconds.
minutes Creates a period with a specified number of minutes.
months Creates a period with a specified number of months.
seconds Creates a period with a specified number of seconds.
now Returns the current date and time.
parse_date Parses a date and time from the given string, according to a strict pattern.
parse_unix_milliseconds Attempts to parse a UNIX millisecond timestamp (milliseconds since 1970-01-01T00:00:00.000Z).
period Parses an ISO 8601 period from the specified string.
weeks Creates a period with a specified number of weeks.
years Creates a period with a specified number of years.
hours Create a period with a specified number of hours.

Debug

These functions are used to determine the state of your program at any point of execution.

Function Description
metric_counter_inc The counter metric name, will always be prefixed with 'org.graylog.rulemetrics.'
debug Print the passed value as a string in the Graylog log.

Encoding

Encoding functions enable you to decode and convert strings.

Function Description
murmur3_128 Returns the hex encoded MurmurHash3 (128-bit) digest of the given string.
murmur3_32 Returns the hex encoded MurmurHash3 (32-bit) digest of the given string.
sha1 Returns the hex encoded SHA1 digest of the given string.
sha256 Returns the hex encoded SHA256 digest of the given string.
sha512 Returns the hex encoded SHA512 digest of the given string.

List

These functions create a collection that can be manipulated for your analysis.

Function Description
first_non_null Returns first non null element found in value.

Lookups

Lookup functions enable you to search a database for a value, then return other information from the same record.

Function Description
lookup Looks up a multi value in the named lookup table.
lookup_add_string_list Lookup table manipulation.
lookup_clear_key Lookup table manipulation.
lookup_remove_string_list Lookup table manipulation.
lookup_set_value Lookup table manipulation.
lookup_string_list Lookup table manipulation.
lookup_set_string_list Lookup table manipulation.
lookup_value Looks up a single value in the named lookup table.

Map

Map functions apply a given function to each element of a collection.

Function Description
select_jsonpath Selects one or more named JSON Path expressions from a JSON tree.

Message Handling

These functions define what is to be done in response to a message.

Function Description
clone_message Clones a message.
create_message Creates a new message which will be evaluated by the entire processing pipeline.
drop_message This currently processed message will be removed from the processing pipeline after the rule finishes.
from_input Checks whether the current message was received by the given input.
remove_field Removes the named field from the currently processed message.
remove_from_stream Removes the current message from the specified stream.
rename_field Renames a message field.
route_to_stream Assigns the current message to the specified stream.
set_field Sets the name field to the given value in the currently processed message.
set_fields Sets multiple fields to the given values in the currently processed message.
traffic_accounting_size Calculates the current size of the message as used by the traffic accounting system.

Pattern Matching

Specify patterns to which some data should conform and deconstructs the data according to those patterns.

Function Description
grok Applies a Grok pattern to a string.
regex Matches a regular expression against a string, with matcher groups.
regex_replace Matches a regular expression against a string and replace with string.

String Functions

These functions are used to manipulate a string or query information about a string.

Function Description
abbreviate Abbreviates a String using ellipses.
base16_decode base16 decoding of the string.
base16_encode base16 encoding of the string.
base32_decode base32 decoding of the string.
base32_encode base32 encoding of the string.
base32human_decode base32 (human-friendly) decoding of the string.
base32human_encode base32 (human-friendly) encoding of the string.
base64_decode base64 decoding of the string.
base64_encode base64 encoding of the string.
base64url_decode base64 (URL-safe) decoding of the string.
base64url_encode base64 (URL-safe) encoding of the string.
capitalize Capitalizes a String changing the first letter to title case.
concat Concatenates two strings.
contains Checks if a string contains another string.
ends_with Checks if a string ends with a given suffix.
flatten_json Parses a string as a JSON tree while flattening all containers to a single level.
join Joins the elements of the provided array into a single String.
lowercase Converts a String to lower case.
length Counts the characters or bytes in a string.
md5 Returns the hex encoded MD5 digest of the given string.
split Splits a string around matches of this pattern (Java syntax).
starts_with Checks if a string starts with a given prefix.
substring Returns a substring of value with the given start and end offsets.
swapcase Swaps the case of a String.
parse_json Parses a string into a JSON tree.
replace Replaces the first “max” or all occurrences of a string within another string.
uncapitalize Uncapitalizes a String changing the first letter to lower case.
uppercase Converts a String to upper case.
urldecode Decodes a application/x-www-form-urlencoded string using a specific encoding scheme.
urlencode Translates a string into application/x-www-form-urlencoded format using a specific encoding scheme.

String Function/Encoding

Function Description
crc32 Returns the hex encoded CRC32 digest of the given string.
crc32c Returns the hex encoded CRC32C (RFC 3720, Section 12.1) digest of the given string.

Was this article helpful?