parseFixedWidth( ) Query Function

Parse a fixed width-encoded field into known columns. It can parse values of the form:

value 1 value 2 value 3, widths [8,8,8] value 1value 2value 3, widths [7,7,7] For a log line like this:

2017-02-22T13:14:01.917+0000 [main thread] INFO statsModule got result="117success 27% 3.14”

Using parseFixedWidth(result, columns=[count, status, completion, precision, sourcetask], widths=[3,9,4,10,10) will add these fields:

count: 117 status: success completion: 27% precision: 3.14 and sourcetask will not get assigned a value, as thee were too few columns in the input for that. Values are trimmed after they have been extracted, i.e. success will become success from the above example.

Use the (unnamed) field parameter to specify which field should be parsed. Specify @rawstring to parse the raw string


Name Type Required Default Description
field string No @rawstring Field that holds the input in fixed width form
columns [string] Yes Names of columns to extract from field
widths [number] Yes Widths of columns.
trim bool No true Remove leading and trailing white-space from fields after extracting

field is the unnamed parameter.


Fixed width parse the result field from a log line: statsModule got result="117success 27% 3.14”. This will add the fields count=117, status=success’, completion=27%andprecision=3.14` to the event. sourcetask will not get set as the input is too short.

parseFixedWidth(result, columns=[count, status, completion, precision, sourcetask], widths=[3,9,4,10,10])