Variables Library

Variables are reusable JavaScript expressions that can be accessed in Functions in any Pipeline.

Variable Scope

​

Variables are scoped to different levels of the application: Single-instance deployment, Worker Group, or Pack. You can only use a variable in the scope in which it is defined.

Single-Instance Deployment Variables

​

To access variables in a Single-instance deployment:

1. Select Home from the sidebar.
2. On the submenu, select Processing, then Knowledge.
3. In the sidebar, select Variables.

You cannot access these variables from a Pack in this deployment.

Worker Group Variables

​

To access variables specific to a given Worker Group:

1. Select Worker Groups from the sidebar, and choose a Worker Group.
2. On the Worker Groups submenu, select Processing, then Knowledge.
3. In the sidebar, select Variables.

You cannot access these variables from a Pack in this Worker Group or deployment.

Pack Variables

​

To access variables that belong to a specific Pack:

1. Select Worker Groups from the sidebar, and choose a Worker Group.
2. On the Worker Groups submenu, select Processing, then Packs.
3. Select the desired Pack.
4. In the Pack submenu, select Knowledge, then in the sidebar select Variables.

You cannot access these variables from outside a Pack (for example, from a Pipeline configured in a Worker Group).

Use Cases

​

Typical use cases for variables include:

• Storing a constant that you can reference from any Function in any Pipeline.
• Storing a relatively long value expression, or one that uses one or more arguments.

Variables can be of the following types:

• Number
• String
• Encrypted String
• Boolean
• Object
• Array
• Expression

Variables can be accessed via C.vars – which can be called anywhere in Cribl Stream that JS expressions are supported. Typeahead is provided. See Cribl Expressions for more information.

When calling C.vars, the value used will depend on the scope of the variable. For example, if you call C.vars.redis from a Pipeline Function in a Pack, the value returned will be the redis Pack variable, not redis as defined in the Worker Group.

Examples

​

Scenario 1

​

Assign field foo the value in theAnswer variable.

• Variable Name: theAnswer
• Variable Value: 42
• Sample Eval Function: foo = C.vars.theAnswer

Scenario 2

​

Assign field nowEpoch the current time, in epoch format.

• Variable Name: epoch
• Variable Value: Date.now()/1000
• Sample Eval Function: nowEpoch = C.vars.epoch()

Scenario 3

​

Create a new field called storage, by converting the value of event field size to human-readable format.

• Variable Name: convertBytes
• Variable Value: `${Math.round(bytes / Math.pow(1024, (Math.floor(Math.log(bytes) / Math.log(1024)))), 2)}${['Bytes', 'KiB', 'MiB', 'GiB', 'TiB', 'PiB', 'EiB', 'ZiB', 'YiB'][(Math.floor(Math.log(bytes) / Math.log(1024)))]}`
  Note the use of quotes or backticks around values. Use the opposite delimiter for the enclosing expression.
• Variable Argument: bytes
• Sample Eval Function: storage = C.vars.convertBytes(size)
  Note the use of bytes here as an argument.