if command: Examples

The following are examples for using the SPL2 if command. To learn more about the if command, see How the SPL2 if command works.

1. Prioritize events by severity level

This example assigns a priority number to each event based on its severity level.

CODE 
... 
| if (level == "critical") [eval priority=1] 
	elseif (level == "high") [eval priority=2]	 
	else [eval priority=3]

2. Label and route events by status code

This pipeline example does the following:

  • Updates events that have status codes greater than 500 with a severity=critical field-value pair.

  • Updates all other events with a severity=normal field-value pair.

  • Routes all events to an Amazon S3 bucket.

PYTHON 
$pipeline = from $source 
| if (status > 500) [eval severity="critical"] 
	else [eval severity="normal"] 
| into $aws_s3_destination