- Release Notes and Announcements
- User Guide
- Product Introduction
- Purchase Guide
- Getting Started
- Operation Guide
- Resource Management
- Permission Management
- Log Collection
- Collection Overview
- Collecting Logs in Self-Built Kubernetes Cluster
- Collecting Syslog
- Collection by LogListener
- Collecting Text Log
- Uploading Log over Kafka
- Uploading Logs via Anonymous Write
- Uploading Logs via Logback Appender
- Uploading Logs via Log4j Appender
- Uploading Log via SDK
- Uploading Log via API
- Importing Data
- Tencent Cloud Service Log Access
- Log Storage
- Search and Analysis
- Syntax and Rules
- Statistical Analysis (SQL)
- Quick Analysis
- SQL Syntax
- SQL Functions
- String Function
- Date and Time Functions
- IP Geographic Function
- URL Function
- Mathematical Calculation Functions
- Mathematical Statistical Function
- General Aggregate Function
- Geospatial Function
- Binary String Function
- Estimation Function
- Type Conversion Function
- Logical Function
- Operators
- Bitwise Operation
- Regular Expression Function
- Lambda Function
- Conditional Expressions
- Array Functions
- Interval-Valued Comparison and Periodicity-Valued Comparison Functions
- JSON Functions
- Window Functions
- Sampling Analysis
- Configuring Indexes
- Reindexing
- Context Search and Analysis
- Downloading Log
- Dashboard
- Data Processing documents
- Data Processing
- Creating Processing Task
- Viewing Data Processing Details
- Data Processing Functions
- Function Overview
- Key-Value Extraction Functions
- Enrichment Functions
- Flow Control
- Row Processing Functions
- Field Processing Functions
- Value Structuring Functions
- Regular Expression Processing Functions
- Time Value Processing Functions
- String Processing Functions
- Type Conversion Functions
- Logical and Mathematical Functions
- Encoding and Decoding Functions
- IP Parsing Functions
- Processing Cases
- Scheduled SQL Analysis
- SCF
- Data Processing
- Shipping and Consumption
- Monitoring Alarm
- Historical Documentation
- Best Practices
- Developer Guide
- API Documentation
- History
- Introduction
- API Category
- Making API Requests
- Topic Management APIs
- Log Set Management APIs
- Index APIs
- Topic Partition APIs
- Machine Group APIs
- Collection Configuration APIs
- Log APIs
- Metric APIs
- Alarm Policy APIs
- Data Processing APIs
- Kafka Protocol Consumption APIs
- CKafka Shipping Task APIs
- Kafka Data Subscription APIs
- COS Shipping Task APIs
- SCF Delivery Task APIs
- Scheduled SQL Analysis APIs
- COS Data Import Task APIs
- Data Types
- Error Codes
- FAQs
- CLS Service Level Agreement
- CLS Policy
- Contact Us
- Glossary
- Release Notes and Announcements
- User Guide
- Product Introduction
- Purchase Guide
- Getting Started
- Operation Guide
- Resource Management
- Permission Management
- Log Collection
- Collection Overview
- Collecting Logs in Self-Built Kubernetes Cluster
- Collecting Syslog
- Collection by LogListener
- Collecting Text Log
- Uploading Log over Kafka
- Uploading Logs via Anonymous Write
- Uploading Logs via Logback Appender
- Uploading Logs via Log4j Appender
- Uploading Log via SDK
- Uploading Log via API
- Importing Data
- Tencent Cloud Service Log Access
- Log Storage
- Search and Analysis
- Syntax and Rules
- Statistical Analysis (SQL)
- Quick Analysis
- SQL Syntax
- SQL Functions
- String Function
- Date and Time Functions
- IP Geographic Function
- URL Function
- Mathematical Calculation Functions
- Mathematical Statistical Function
- General Aggregate Function
- Geospatial Function
- Binary String Function
- Estimation Function
- Type Conversion Function
- Logical Function
- Operators
- Bitwise Operation
- Regular Expression Function
- Lambda Function
- Conditional Expressions
- Array Functions
- Interval-Valued Comparison and Periodicity-Valued Comparison Functions
- JSON Functions
- Window Functions
- Sampling Analysis
- Configuring Indexes
- Reindexing
- Context Search and Analysis
- Downloading Log
- Dashboard
- Data Processing documents
- Data Processing
- Creating Processing Task
- Viewing Data Processing Details
- Data Processing Functions
- Function Overview
- Key-Value Extraction Functions
- Enrichment Functions
- Flow Control
- Row Processing Functions
- Field Processing Functions
- Value Structuring Functions
- Regular Expression Processing Functions
- Time Value Processing Functions
- String Processing Functions
- Type Conversion Functions
- Logical and Mathematical Functions
- Encoding and Decoding Functions
- IP Parsing Functions
- Processing Cases
- Scheduled SQL Analysis
- SCF
- Data Processing
- Shipping and Consumption
- Monitoring Alarm
- Historical Documentation
- Best Practices
- Developer Guide
- API Documentation
- History
- Introduction
- API Category
- Making API Requests
- Topic Management APIs
- Log Set Management APIs
- Index APIs
- Topic Partition APIs
- Machine Group APIs
- Collection Configuration APIs
- Log APIs
- Metric APIs
- Alarm Policy APIs
- Data Processing APIs
- Kafka Protocol Consumption APIs
- CKafka Shipping Task APIs
- Kafka Data Subscription APIs
- COS Shipping Task APIs
- SCF Delivery Task APIs
- Scheduled SQL Analysis APIs
- COS Data Import Task APIs
- Data Types
- Error Codes
- FAQs
- CLS Service Level Agreement
- CLS Policy
- Contact Us
- Glossary
Function geo_parse
Function definition
This function is used to parse the geographical location.
Syntax description
geo_parse(field value, keep=("country","province","city"), ip_sep=",")
Parameter description
Parameter | Description | Type | Required | Default Value | Value Range |
data | IP value. Separate multiple IPs by separator. | string | Yes | - | - |
keep | The field to be reserved | string | No | ("country","province","city") | - |
ip_sep | The number of the expression in the match result | string | No | - | - |
Sample
Example 1
Raw log:
{"ip":"101.132.57.150"}
Processing rule:
fields_set("result", geo_parse(v("ip")))
Processing result:
{"ip":"101.132.57.150","result":"{\\"country\\":\\"China\\",\\"province\\":\\"Shanghai\\",\\"city\\":\\"Shanghai\\"}"}
Example 2
Raw log:
{"ip":"101.132.57.150,101.14.57.157"}
Processing rule:
fields_set("result", geo_parse(v("ip"),keep="province,city",ip_sep=","))
Processing result:
{"ip":"101.132.57.150,101.14.57.157", "result":"{\\"101.14.57.157\\":{\\"province\\":\\"Taiwan\\",\\"city\\":\\"NULL\\"},\\"101.132.57.150\\":{\\"province\\":\\"Shanghai\\",\\"city\\":\\"Shanghai\\"}}"}
Function is_subnet_of
Function definition
This function is used to check whether an IP is in the target IP range. Multiple IP ranges are supported.
Syntax description
is_subnet_of(IP range list, IP)
Parameter description
Parameter | Description | Type | Required | Default Value | Value Range |
IP range list | IP range. Separate multiple IP ranges by comma. | String | Yes | - | - |
IP | The IP to be checked | String | Yes | - | - |
Sample
Example 1
Raw log:
{"ip": "192.168.1.127"}
Processing rule:
log_keep(is_subnet_of("192.168.1.64/26",v("ip")))
Processing result:
{"ip": "192.168.1.127"}
Example 2
Raw log:
{"ip": "192.168.1.127"}
Processing rule:
fields_set("is_subnet",is_subnet_of("192.168.1.64/26",v("ip")))
Processing result:
{"ip": "192.168.1.127", "is_subnet":"true"}
Example 3
Raw log:
{"ip": "192.168.1.127"}
Processing rule:
fields_set("is_subnet",is_subnet_of("172.16.0.0/16",v("ip")))
Processing result:
{"ip": "192.168.1.127", "is_subnet":"false"}
Example 4
Raw log:
{"ip": "192.168.1.127"}
Processing rule:
fields_set("is_subnet",is_subnet_of("172.16.0.0/16,192.168.1.64/26",v("ip")))
Processing result:
{"ip": "192.168.1.127", "is_subnet":"true"}
Yes
No
Was this page helpful?