- 4 minutes to read

Formula

You hide it, we find it! Learn how to extract and modify returned values from any data structure

The formula plugin helps you extract any value from any given message by applying one or more (nested) functions. The Nodinite formula plugin, works much like formulas in Microsoft Excel (with the functions listed in the reference table below)

The Formula plugin supports many powerful functions, (Multilevel Nested Functions) which is the key feature of this search field expressions plugin. However, it is too early to consider it right away. We will demonstrate this as we move further with the examples (Test Expressions).

Where do the extracted values come from?

The extracted values come from the Body and/or Context that was logged by the Nodinite Logging Agents or from custom logged Log Events.

The documentation for the Formula plugin uses the notion of Content meaning either the Body (actual payload), Context or Result from previous Formula operation.

Content

The operations execute on data that comes from any of the following:

  • body

    • Flatfile and CSV structures
    • JSON
    • XML

  • context

    • Key/Value

  • field New 6.1

    • Any of the pre-defined fields (case-sensitive)

  • The result from a previous Formula operation

The Formula Plugin has different types of functions for example math, string, logical, base64, and these can be nested like:

  • function(content)
  • function(expression, content)
  • function(1st expression, 2nd expression, content)
  • function(1st expression, 2nd exp.., 3rd.., ..., content)
  • function(content, ..., content)

Sources:

Function Description
body Returns the whole Body part as a string from the payload of the logged event
context('Key Name1') Returns the value of the specified name from the collection of Context Values of the logged event
context(regex('Key Name.*')) Returns the values of the Regular Expression matching names from the collection of Context Values of the logged event
contextKey(regex('Key Name.*')) Returns the keys of the Regular Expression matching names from the collection of Context Keys of the logged event
field Return the value for the named field'

Extract:

Function Description
csv(headerRowsToSkip, 'delimiter', columnIndex, 'commentSymbol', content) Extract data from any valid CSV file
jsonPath('expression', content) Used to extract value for the given path from a JSON valid structure
jsonPathKey('expression', content) Used to extract keys for the given path from a JSON valid structure
regex('expression', content) Use Regular Expression as it is implemented everywhere to extract values
regexGroup('expression', 'groups', content) Use Regular Expression and get the value from selected groups as it is implemented everywhere to extract values
xPath('expression', content) Retrieve values from XML body using a fast forward only reader XPath 1.0
xPath2('expression', content) Retrieve values from XML body using a XPath 2.0 (high memory usage)

Convert:

Function Description
base64decode(content [, 'source encoding']) Decode the provided data into a human-readable format
base64encode(content [,'input encoding']) Encode text to base64
convert('source encoding','target encoding',content) Convert encoding from source encoding to target encoding New 5.4
toLowerCase(content) Convert any given text to 'lower case'
toUpperCase(content) Convert any given text to 'UPPER CASE'

Alter:

Function Description
concat(content, ..., content) Can be used as a source, or concatenate any number of parameters
replace('oldValue', 'newValue',Content) Used to replace old text/letter with a new text.
substring(startIndex0, length, content) Extract specific text from any given statement/text
removebom(content Remove the BOM if it exists New 5.4

Logical:

Function Description
equal('expression', content) Check the equality of two given texts
endsWith('expression', content) Check if text ends with certain word/letter
isnull('expression', content) Check if value is null, if so return a default value, otherwise return the valueNew 6.1
notEqual('expression', content) Check the inequality of two given texts
startsWith('expression', content) Check if text starts with certain word/letter

Math Functions :

Function Description
count(Content, [bool unique = false]) Return the count of the extracted values, based on the result of any previous operation
sum(Content, [bool unique = true]) Return the sum of the extracted values, based on the result of any previous operation
length(content, [bool unique = true]) Returns the numerical value(s) with the Length of the content
min(content, [bool unique = true]) Return the minimum value of numerical values, returns nothing if no numerical values was found
max(content, [bool unique = true]) Return the maximum value of numerical values, returns nothing if no numerical values was found
avg(content, [bool unique = true]) Return the average value of numerical values, returns nothing if no numerical values was found New 5.5

Single quotes

If your expression includes single quotes (apostrophe), you need to escape them using an extra single quote.

From To
' ''

Single Quotes
Example of escaping single quotes.

Next Step

How to Add or manage Search Fields
How to Add or manage Log Views

Expression Type Plugins are used in Search Fields.
What are Search Fields?
What are Search Field Expressions?
What are Message Types?
What are Log Views?