Cribl - Docs

Getting started with Cribl LogStream

Questions? We'd love to help you! Meet us in #cribl (sign up)

Changelog    Guides



The Eval function adds or removes fields from events. (In Splunk these are index-time fields).


Filter: Filter expression (JS) that selects data to be fed through the function. Defaults to empty - all events will be evaluated.

Description: Simple description about this function. Defaults to empty.

Final: If true, stops data from being fed to the downstream functions. Defaults to No.

Evaluate Fields: Set of key-value pairs to add. Left-hand side input is the key name, right-hand side is a JS expression to compute the value (can be constant).

Keep Fields: List of fields to keep. Wildcards (*) supported. Takes precedence over Remove Fields (below).

Remove Fields: List of fields to remove. Wildcards (*) supported. Cribl internal fields that start with __ (double underscore) cannot be remove via wildcard. Instead they need to be specified individually. For example, __myField cannot be removed by specifying __myF. A field matching an entry in Keep (wildcard or not) and Remove will not be removed. This is useful for implementing “remove all but” functionality. For example, to only keep _time, _raw, source, sourcetype, host we can specify them all in Keep while specifying * in Remove.


See Index-time Fields for examples.

Advanced Usage Notes

Note 1:

The Eval function has the ability to execute expressions without assigning their value to the field of an event. This can be done by simply leaving the left-hand side input empty and having the right hand side do the assignment.

  • Simple Example: Object.assign(foo, JSON.parse(bar), JSON.parse(baz)) on the right-hand side (and left-hand side empty) will json parse the strings in bar and baz, merge them and assign their value to foo, an already existing field.
  • Another Example: To parse JSON enter Object.assign(__e, JSON.parse(_raw)) on the right-hand side (and left-hand side empty). __e is a special variable that refers to the (context) event within a JS Expression. In this case, content parsed from _raw is added at the top level of the event.

Note 2:

The Eval function can also be used to set and unset control fields (e.g., _TCP_ROUTING in Splunk) via this syntax: _ctrl.<name>. They can only be referenced on the left hand side of Add i.e. they cannot be read or used on the right hand side, and cannot be referenced in Remove. To unset/delete, set the value to undefined. These fields are normally not needed for event computations and modifying them is suggested to be done only by experts. Please reach out to Cribl team if you need help with this topic.