On This Page

Home / Edge/ Functions/Code

Code

If you need to operate on data in a way that can’t be accomplished with Cribl Edge’s out-of-the-box Functions, the Code Function enables you to encapsulate your own JavaScript code. This Function imposes some restrictions for security reasons.

Code Function Walkthrough
​

This video provides a one-minute walkthrough of the Cribl Edge Code Function.

Restrictions
​

Generally speaking, anything forbidden in JavaScript strict mode is forbidden in the context of the Code Function. Specifically, the following are not allowed:

  • console, eval, uneval, Function (constructor), Promises, setTimeout, setInterval, global, globalThis, window, and set.

Code Functions can include for loops, while loops, and JavaScript methods such as map, reduce, forEach, some, and every. For further details, see Supported JavaScript Options.

Cribl Edge’s predefined Functions, such as Eval, cover the vast majority of scenarios that users typically need to implement. You should use Code Functions only as a last resort, when you need to construct a complex block of code.

Also, only skilled JavaScript developers should define Code Functions. This is to avoid unintended results – such as creating infinite loops, or otherwise failing to return – that could needlessly add to your throughput burden.

Usage
​

When added to a Pipeline, the Code Function offers the following configuration options:

Filter: JavaScript filter expression that selects data to feed through the Function. Defaults to true, meaning it evaluates all events.

Description: Optionally, add a simple description of this Function.

Final: Toggle on to stop feeding data to the downstream Functions. Default is toggled off.

Code: The mini-editor where you type your JavaScript code.

Advanced Settings
​

Iteration limit: The maximum number of iterations per instance of this Code Function. Defaults to 5000; highest allowed value is 10000.

Error log sample rate: Specifies the rate at which this Code Function logs errors. For example, a value of 1 logs every error; a value of 10 logs every tenth error. The highest allowed value is 5000. Defaults to 1.

Use unique log channel: When enabled, Cribl Edge sends logs from this function to a unique channel in the form func:code:${pipelineName}:${functionIndex}. Toggle off to use the generic func:code log channel instead.

Notes and Examples
​

Functions (including the Code Function) always use the special variable __e to access the (context) event inside JavaScript expressions.

Possibly the simplest Code Function creates a new field and then assigns it a value:

A Basic Code Function
__e['foo'] = 'Hello, Goats!'

For more ambitious implementations, see Code Function Examples.

JavaScript Support
​

Cribl Edge supports the ECMAScript® 2015 Language Specification.

With some exceptions, the Code Function supports the options described in the following MDN JavaScript Guide topics: