tencent cloud

Cloud Log Service

Dictionary and List Functions

Download
Mode fokus
Ukuran font
Terakhir diperbarui: 2026-07-02 21:33:23

Dictionary Functions

json_add Function

Function Definition

Add a node to the json.

Syntax Description

json_add(key,data)

Parameter Description

Parameter Name
Parameter Description
Parameter Type
Required
Default Value
Parameter Value Range
key
The key corresponding to json
string
Yes
-
-
data
Add new nodes
dict
Yes
-
-

Example

Raw log:
{"content": "{\\"a\\":{\\"b\\":{\\"c\\":\\"cc\\"}}}"}
Processing rules:
json_add("content", {"a":{"b":{"d":"dd"}}})
Processing result:
{"content": "{\\"a\\":{\\"b\\":{\\"c\\":\\"cc\\",\\"d\\":\\"dd\\"}}}"}

json_edit Function

Function Definition

Add, modify, or delete key-value pairs in a dictionary and return the dict.

Syntax Description

json_edit("result", path="", key="",value="333",index=1,mode="edit")

Parameter Description

Parameter Name
Parameter Description
Parameter Type
Required
Default Value
Parameter Value Range
field
The key corresponding to the nested json
string
Yes
-
-
path
The directory corresponding to the target field to be deleted or modified. Leave this field blank if the field to be deleted or modified is at the first level of the nested json. When operating on array elements, fill in the key corresponding to the array. Supports JMES syntax.
string
No
-
-
key
The target field to be deleted or modified. Leave this field blank when operating on array elements.
string
No
-
-
value
The new value to be set. Required only when a value is modified.
string
No
-
-
index
Fill in this field when operating on an array. Array elements start from 1.
number
No
0
-
mode
Mode. Edit: edit, Delete: move. Default: move
string
No
move
-

Example 1: Modifying the Value of a Specified Node

Raw log:
{"content":"{\\"p9\\":[\\"0.0\\",\\"0.0\\"],\\"p18\\":\\"CN\\"}","time":"1650440364"}

Processing rules:
json_edit("content", path="", key="p18", value="hello", mode="edit")
Processing result:
{"content":"{\\"p9\\":[\\"0.0\\",\\"0.0\\"],\\"p18\\":\\"hello\\"}", "time":"1650440364"}

Example 2: Modifying the Value of a Specified Node (Multi-Level)

Raw log:
{"content":"{\\"p9\\":[\\"0.0\\",\\"0.0\\"],\\"p18\\":\\"CN\\",\\"info\\":{\\"province\\":\\"hubei\\",\\"geo\\":{\\"long\\":\\"111\\",\\"lati\\":\\"222\\"}}}","time":"1650440364"}
Processing rules:
json_edit("content", path="info.geo", key="long", value="333", mode="edit")
Processing result:
{"content":"{\\"p9\\":[\\"0.0\\",\\"0.0\\"],\\"p18\\":\\"CN\\",\\"info\\":{\\"province\\":\\"hubei\\",\\"geo\\":{\\"long\\":\\"333\\",\\"lati\\":\\"222\\"}}}","time":"1650440364"}

Example 3: Deleting a Node

Raw log:
{"content":"{\\"p9\\":[\\"0.0\\",\\"0.0\\"],\\"p18\\":\\"CN\\",\\"info\\":{\\"province\\":\\"hubei\\",\\"geo\\":{\\"long\\":\\"111\\",\\"lati\\":\\"222\\"}}}","time":"1650440364"}
Processing rules:
json_edit("content", path="", key="p18", mode="move")
Processing result:
{"content":"{\\"p9\\":[\\"0.0\\",\\"0.0\\"],\\"info\\":{\\"province\\":\\"hubei\\",\\"geo\\":{\\"long\\":\\"111\\",\\"lati\\":\\"222\\"}}}","time":"1650440364"}

Example 4: Deleting a Node (Array Element)

Raw log:
{"content":"{\\"p9\\":[\\"0.0\\",\\"0.0\\"],\\"p18\\":\\"CN\\",\\"info\\":{\\"province\\":[\\"hello\\",\\"world\\"],\\"geo\\":{\\"long\\":[\\"1.0\\",\\"2.0\\"],\\"lati\\":\\"222\\"}}}","time":"1650440364"}
Processing rules:
json_edit("content", path="info.province", index=1, mode="move")
Processing result:
{"content":"{\\"p9\\":[\\"0.0\\",\\"0.0\\"],\\"p18\\":\\"CN\\",\\"info\\":{\\"province\\":[\\"world\\"],\\"geo\\":{\\"long\\":[\\"1.0\\",\\"2.0\\"],\\"lati\\":\\"222\\"}}}","time":"1650440364"}

json_select Function

Function Definition

Extract JSON field values using JMES expressions and return the node values (String) extracted by JMES.

Syntax Description

json_select(data, jmes="")

Parameter Description

Parameter Name
Parameter Description
Parameter Type
Required
Default Value
Parameter Value Range
data
Field value, which can be extracted by other functions.
string
Yes
-
-
jmes
string
Yes
-
-

Example

Raw log:
{"field": "{\\"a\\":{\\"b\\":{\\"c\\":{\\"d\\":\\"success\\"}}}}", "status": "500"}
Processing rules:
fields_set("message", json_select(v("field"), jmes="a.b.c.d"))
Processing result:
{"field":"{\\"a\\":{\\"b\\":{\\"c\\":{\\"d\\":\\"success\\"}}}}","message":"success","status":"500"}

json_update Function

Function Definition

Add KV pairs to the json. Add the user-provided Strings in pairs. Any single String that does not form a pair is discarded (see Example 2).

Syntax Description

json_update(json_value, key1, value1, key2, value2)

Parameter Description

Parameter Name
Parameter Description
Parameter Type
Required
Default Value
Parameter Value Range
field
The key corresponding to json
string
Yes
-
-
Variable parameter
The key-value pairs to be added into the json
string
Yes
-
-

Example 1: Adding a KV Pair to json

Raw logs:
{"data": "{\\"c\\":\\"d\\"}"}
Processing rules:
json_update("data", "11", "22")
Processing result:
{"data":"{\\"11\\":\\"22\\",\\"c\\":\\"d\\"}"}

Example 2: Adding a KV Pair to json, Unpaired Items (for example, 33) Are Discarded

Raw log:
{
"data": "{\\"c\\":\\"d\\"}",
"name": "test",
"timestamp": 1734567890,
"status": true
}
Processing rules:
json_update("data", "11", "11", "22", "22", "33")
Processing result:
{
"data":"{"11":"11","22":"22","c":"d"}",
"name": "test",
"status":"true",
"timestamp":"1734567890"
}

xml_to_json Function

Function Definition

Parse the XML value and convert it to a JSON string. The input value must be in XML string format; otherwise, a conversion exception occurs. A dict is returned.

Syntax Description

xml_to_json(data)

Parameter Description

Parameter Name
Parameter Description
Parameter Type
Required
Default Value
Parameter Value Range
data
Field Value
string
Yes
-
-

Example

Raw log:
{"xml_field": "<note><to>B</to><from>A</from><heading>Reminder</heading><body>Don't forget me this weekend!</body></note>", "status": "500"}
Processing rules:
fields_set("json_field", xml_to_json(v("xml_field")))
Processing result:
{"xml_field":"<note><to>B</to><from>A</from><heading>Reminder</heading><body>Don't forget me this weekend!</body></note>","json_field":"{\\"to\\":\\"B\\",\\"from\\":\\"A\\",\\"heading\\":\\"Reminder\\",\\"body\\":\\"Don't forget me this weekend!\\"}","status":"500"}

json_to_xml Function

Function Definition

Parse the JSON string value and convert it to an XML string. A String is returned.

Syntax Description

json_to_xml(data)

Parameter Description

Parameter Name
Parameter Description
Parameter Type
Required
Default Value
Parameter Value Range
data
Field Value
string
Yes
-
-

Example

Raw log:
{"json_field":"{\\"to\\":\\"B\\",\\"from\\":\\"A\\",\\"heading\\":\\"Reminder\\",\\"body\\":\\"Don't forget me this weekend!\\"}", "status": "200"}
Processing rules:
fields_set("xml_field", json_to_xml(v("json_field")))
Processing result:
{"json_field":"{\\"to\\":\\"B\\",\\"from\\":\\"A\\",\\"heading\\":\\"Reminder\\",\\"body\\":\\"Don't forget me this weekend!\\"}","xml_field":"<ObjectNode><to>B</to><from>A</from><heading>Reminder</heading><body>Don't forget me this weekend!</body></ObjectNode>","status":"200"}

if_json Function

Function Definition

Determine whether the value is a JSON string. TRUE/FALSE is returned.

Syntax Description

if_json(data)

Parameter Description

Parameter Name
Parameter Description
Parameter Type
Required
Default Value
Parameter Value Range
data
Field Value
string
Yes
-
-

Example

Example 1
Raw log:
{"condition":"{\\"a\\":\\"b\\"}","status":"500"}
Processing Statement:
t_if(if_json(v("condition")), fields_set("new", 1))
Processing result:
{"new":"1","condition":"{\\"a\\":\\"b\\"}","status":"500"}
Example 2
Raw log:
{"condition":"haha","status":"500"}
Processing Statement:
t_if(if_json(v("condition")), fields_set("new", 1))
Processing result:
{"condition":"haha","status":"500"}

List Functions

array_get Function

Function Definition

Obtain the value of the array. A String is returned.

Syntax Description

array_get(array, index)

Parameter Description

Parameter Name
Parameter Description
Parameter Type
Required
Default Value
Parameter Value Range
Array
Array
string
Yes
-
-
Index position
Retrieve the value at a specified index in the array
int
Yes
-
-

Example 1

Raw log:
{
"field1": "[1,2,3]"
}
Processing rules:
fields_set("field2", array_get(v("field1"), 0))
Processing result:
{"field1":"[1,2,3]","field2":"1"}

Example 2

Raw log:
{
"field1": "['tom','jerry','bobo']"
}
Processing rules:
fields_set("field2", array_get(v("field1"), 0))
Processing result:
{"field1":"['tom','jerry','bobo']","field2":"tom"}



Bantuan dan Dukungan

Apakah halaman ini membantu?

masukan