Conversion Functions

Details of the following conversion functions are available.

LOG Function

LOG(<field>, <base>) calculates the log of a numeric <field> to its <base>.

Syntax

LOG(<field>, <base>)

  • <field> is a numeric eventAttribute. <base> is optional and default is 10.

LOG(FUNCTION(<field>), <base>)

  • Function must return a numeric value. <base> is optional and default is 10.

Elasticsearch does not support nested functions.

In ClickHouse, these nested function categories are allowed:

  • Aggregation Functions, Conversion Functions, Evaluate-and-Set Function

Scope

Available for ClickHouse and Elasticsearch queries from 7.0.0 onwards.

Example

hostName

recvBytes64

LOG(recvBytes64,10)

LOG(recvBytes64,”e”)

Host1

 

6.67

15.36

Host2

 

7.35

16.73

Host3

 

2.66

6.12

TO_DOUBLE Function

TO_DOUBLE(<field>) converts a string valued event attribute X to a double number.

Syntax

TO_ DOUBLE (<field>)

  • <field> is a string valued eventAttribute or a Function of an eventAtribute that returns a string

TO_ DOUBLE (FUNCTION(<field>))

  • Function must return a STRING value

Elasticsearch does not support nested functions.

In ClickHouse, these nested function categories are allowed:

  • Conversion Functions, Extraction Functions, String Manipulation Functions
    Note: Only LEN allowed in String Manipulation Functions

Scope

Available for ClickHouse and Elasticsearch queries from 7.0.0 onwards.

Example

attr1

TO_DOUBLE(attr1)

“1234.56”

1234.56

“-1234.56”

-1234.56

TO_INTEGER Function

TO_INTEGER(<field>, <base>) converts a string valued <field> to a integer with <base>. <base> is optional and default is 10.

Syntax

TO_ INTEGER (<field>, <base>)

  • <field> is a string valued eventAttribute or a Function of an eventAtribute that returns a string
  • <base> is an integer. It is optional and default is 10

TO_ INTEGER (FUNCTION(<field>), <base>)

  • Function must return a STRING value
  • <base> is an integer. It is optional and default is 10

In Elasticsearch, nesting is not supported.

In ClickHouse, these nested function categories are allowed:

  • Conversion Functions, Extraction Functions, String Manipulation Functions
    Note: Only LEN allowed in String Manipulation Functions

Scope

Available for ClickHouse and Elasticsearch queries from 7.0.0 onwards.

Example

field

TO_INTEGER(field,10)

TO_INTEGER(field,2)

TO_NUMBER(field,16)

“1000”

1000

1111101000

3E8

“1234”

1234

10011010010

4D2

Restrictions

  1. <field> has to be string representation of an integer.
  2. If <base> is 2 or 16, X must be a string representation of a positive integer.

TO_STRING Function

TO_STRING(<field>) converts an input <field> to a string. If the <field> is an integer, then it reformats the number as a string. If the <field> is an Boolean value, then it returns “True” of “False”.

Syntax

TO_STRING(<field>)

  • <field> is a numeric eventAttribute, or a Function returning a number, or a Boolean expression.
  • Return value: If the <field> is an integer, then it reformats the number as a string. If the <field> is an Boolean value, then it returns “True” of “False”.

TO_STRING(FUNCTION(<field>))

  • Function must return a numeric value or a Boolean expression.
  • Return value: If the <field> is an integer, then it reformats the number as a string. If the <field> is an Boolean value, then it returns “True” of “False”.

Elasticsearch does not support nested functions.

In ClickHouse, these nested function categories are allowed:

  • Conversion Functions, Evaluate-and-Set Function, Extraction Functions

Scope

Available for ClickHouse and Elasticsearch queries from 7.0.0 onwards.

Example

attr1

TO_STRING(attr1)

1234

“1234”

1234.56

“-1234.56”