Crib LogStream - Docs

Getting started with Cribl LogStream

Questions? We'd love to help you! Meet us in #cribl (sign up)
Download manual as PDF - v2.1

    Docs Home



The Eval function adds or removes fields from events. (In Splunk these are index-time fields).


Filter: Filter expression (JS) that selects data to be fed through the function. Defaults to empty - all events will be evaluated.
Description: Simple description about this function. Defaults to empty.
Final: If true, stops data from being fed to the downstream functions. Defaults to No.

Evaluate Fields: Set of key-value pairs to add. Left-hand side input is the key name, right-hand side is a JS expression to compute the value (can be constant). Nested addressing supported.

Keep Fields: List of fields to keep. Wildcards (*) and nested addressing supported. Takes precedence over Remove Fields (below).

Remove Fields: List of fields to remove. Wildcards (*) and nested addressing supported. supported. Cribl LogStream internal fields that start with __ (double underscore) cannot be remove via wildcard. Instead they need to be specified individually. For example, __myField cannot be removed by specifying __myF*. A field matching an entry in Keep (wildcard or not) and Remove will not be removed. This is useful for implementing “remove all but” functionality. For example, to only keep _time, _raw, source, sourcetype, host we can specify them all in Keep while specifying * in Remove.

  • Note: Negated terms are supported in both Keep Fields and Remove Fields. List is order sensitive when negated terms are used. E.g., !foobar, foo* means "All fields that start with 'foo' except foobar". !foo*, * means "All fields except for those that start with 'foo'".


Scenario A: Create field myField with static value of value1:

  • Name: myField
  • Value Expression: value1

Scenario B: Set field action to blocked if login==error

  • Name: action
  • Value Expression: login=='fail' ? 'blocked' : action

Scenario C: Create a multivalued field called myTags. (i.e. array)

  • Name: myTags
  • Value Expression: ['failed', 'blocked']

Scenario D: Add value error to a multivalued field myTags

  • Name: myTags
  • Value Expression: login=='error' ? [...myTags, 'error'] : myTags

See Ingest-time Fields for more examples.

Advanced Usage Notes

Note 1:

The Eval function has the ability to execute expressions without assigning their value to the field of an event. This can be done by simply leaving the left-hand side input empty and having the right hand side do the assignment.

  • Simple Example: Object.assign(foo, JSON.parse(bar), JSON.parse(baz)) on the right-hand side (and left-hand side empty) will json parse the strings in bar and baz, merge them and assign their value to foo, an already existing field.
  • Another Example: To parse JSON enter Object.assign(__e, JSON.parse(_raw)) on the right-hand side (and left-hand side empty). __e is a special variable that refers to the (context) event within a JS Expression. In this case, content parsed from _raw is added at the top level of the event.

Note 2:

The Eval function can also be used to set and unset control fields (e.g., _TCP_ROUTING in Splunk) via this syntax: _ctrl.<name>. They can only be referenced on the left hand side of Add i.e. they cannot be read or used on the right hand side, and cannot be referenced in Remove. To unset/delete, set the value to undefined. These fields are normally not needed for event computations and modifying them is suggested to be done only by experts. Please reach out to Cribl team if you need help with this topic.

Updated 2 months ago


Suggested Edits are limited on API Reference Pages

You can only suggest edits to Markdown body content, but not to the API spec.