Log Monitoring Classic
The script in a processor definition operates with strongly typed data: the functions and operators accept only declared types of data. The type is assigned to all input fields defined by the USING command as well as to the variables created while parsing or using the casting functions.
Whatever type has a field that is a part of the processor output, the system makes its best effort to convert it to a type expected by the event. The same applies to the input fields defined by the USING command. For example, a STRING attribute with the value 123 can be easily converted to the INTEGER type, but not to the BOOLEAN type.
Data types supported by the USING command (processor input/output):
Data type
Description
BOOLEAN
Has only two possible values: true and false.
INTEGER
A 32-bit signed two's complement integer that has a minimum value of -2^31 and a maximum value of 2^31-1.
LONG
A 64-bit two's complement integer. The signed long has a minimum value of -2^63 and a maximum value of 2^63-1.
DOUBLE
A double-precision 64-bit IEEE 754 floating point. The range of its values is beyond the scope of this discussion, but is specified in the Floating-Point Types, Formats, and Values section of the Java Language Specification.
DURATION
A time period in nanoseconds.
STRING
A sequence of characters with a specified character set.
TIMESTAMP
A reference to a point in time with a precision of nanoseconds.
IPADDR
Represents an IPv4 or IPv6 address.
Additionally, within the processor script itself, more data types may appear after parsing:
Data type
Description
BYTES
An sequence of bytes.
TUPLE
A set of key-value pair data whose value can be any of supported data types.
VARIANT
A data type evaluated dynamically at runtime. VARIANT can represent any of the primitive data types.
VARIANT_ARRAY
An array of VARIANT type data.
VARIANT_OBJECT
A set of key-value pairs with STRING type keys and VARIANT type values. VARIANT_OBJECT is created when parsing JSON objects.