Arbiter Built-in Functions¶

`append`¶

Function description: Appends a value to a list.

Function parameters:

li: The list to append to.
v: The value to append.

Function return value:

list: The list with the appended value.

Function examples:

Example 0:

Script content:

v = [1, 2, 3]
v = append(v, 4)
printf("%v", v)

Standard output:

[1,2,3,4]

Example 1:

Script content:

v = [1, 2, 3]
v = append(v, "a", 1.1)
printf("%v", v)

Standard output:

[1,2,3,"a",1.1]

`b64dec`¶

Function prototype: fn b64dec(data: str) -> (str, bool)

Function description: Base64 decoding.

Function parameters:

data: Data that needs to be base64 decoded.

Function return value:

str: The decoded string.
bool: Whether decoding is successful.

Function examples:

Example 0:

Script content:

v = "aGVsbG8sIHdvcmxk"
v, ok = b64dec(v)
if ok {
    printf("%v", v)
}

Standard output:

hello, world

`b64enc`¶

Function prototype: fn b64enc(data: str) -> (str, bool)

Function description: Base64 encoding.

Function parameters:

data: Data that needs to be base64 encoded.

Function return value:

str: The encoded string.
bool: Whether encoding is successful.

Function examples:

Example 0:

Script content:

v = "hello, world"
v = b64enc(v)
printf("%v", v)

Standard output:

aGVsbG8sIHdvcmxk

`call_func`¶

Function prototype: fn call_func(name: str, kwargs: map = {}) -> map

Function description: Calling remote functions on the Function platform

Function parameters:

name: Remote function name.
kwargs: Parameter map, corresponding to **kwargs in Python.

Function return value:

map:

Function examples:

Example 0:

Script content:

result = call_func("echo", {
    "arg_1": "1",
    "arg_2": [12,3],
    "key3": "true"
})
printf("%v", result)

Standard output:

{"error":"","message":"","ok":true,"reason":"","result":{"arg_1":"1","arg_2":[12,3],"kwargs":{"key3":"true"}}}

Example 1:

Script content:

result = call_func("echo", {"arg_2": [12,3]})
printf("%v", result)

Standard output:

{"detail":{"exeception":"TypeError(\"echo() missing 1 required positional argument: 'arg_1'\")"},"error":"call function failed, api status code 599","message":"Func task failed","ok":false,"reason":"EFuncFailed"}

`cast`¶

Function prototype: fn cast(val: bool|int|float|str, typ: str) -> bool|int|float|str

Function description: Convert the value to the target type.

Function parameters:

val: The value of the type to be converted.
typ: Target type. One of (bool, int, float, str).

Function return value:

bool|int|float|str: The value after the conversion.

Function examples:

Example 0:

Script content:

v1 = "1.1"
v2 = "1"
v2_1 = "-1"
v3 = "true"

printf("%v; %v; %v; %v; %v; %v; %v; %v\n",
    cast(v1, "float") + 1,
    cast(v2, "int") + 1,
    cast(v2_1, "int"),
    cast(v3, "bool") + 1,

    cast(cast(v3, "bool") - 1, "bool"),
    cast(1.1, "str"),
    cast(1.1, "int"),
    cast(1.1, "bool")
)

Standard output:

2.1; 2; -1; 2; false; 1.1; 1; true

`cidr`¶

Function prototype: fn cidr(ip: str, mask: str) -> bool

Function description: Check the IP whether in CIDR block

Function parameters:

ip: The ip address
mask: The CIDR mask

Function return value:

bool: Whether the IP is in CIDR block

Function examples:

Example 0:

Script content:

ip = "192.0.2.233"
if cidr(ip, "192.0.2.1/24") {
    printf("%s", ip)
}

Standard output:

192.0.2.233

Example 1:

Script content:

ip = "192.0.2.233"
if cidr(mask="192.0.1.1/24", ip=ip) {
    printf("%s", ip)
}

Standard output:

`delete`¶

Function prototype: fn delete(m: map, key: str)

Function description: Delete key from the map.

Function parameters:

m: The map for deleting key
key: Key need delete from map.

Function examples:

Example 0:

Script content:

v = {
    "k1": 123,
    "k2": {
        "a": 1,
        "b": 2,
    },
    "k3": [{
        "c": 1.1, 
        "d":"2.1",
    }]
}
delete(v["k2"], "a")
delete(v["k3"][0], "d")
printf("result group 1: %v; %v\n", v["k2"], v["k3"])

v1 = {"a":1}
v2 = {"b":1}
delete(key="a", m=v1)
delete(m=v2, key="b")
printf("result group 2: %v; %v\n", v1, v2)

Standard output:

result group 1: {"b":2}; [{"c":1.1}]
result group 2: {}; {}

`dql`¶

Function prototype: fn dql(query: str, qtype: str = "dql", limit: int = 10000, offset: int = 0, slimit: int = 0, time_range: list = []) -> map

Function description: Query data using dql or promql.

Function parameters:

query: DQL or PromQL query statements.
qtype: Query language, One of dql or promql, default is dql.
limit: Query limit.
offset: Query offset.
slimit: Query slimit.
time_range: Query timestamp range, the default value can be modified externally by the script caller.

Function return value:

map: Query response.

Function examples:

Example 0:

Script content:

v = dql("M::cpu limit 2 slimit 2")
v, ok = dump_json(v, "    ")
if ok {
    printf("%v", v)
}

Standard output:

{
    "series": [
        [
            {
                "columns": {
                    "time": 1744866108991,
                    "total": 7.18078381,
                    "user": 4.77876106
                },
                "tags": {
                    "cpu": "cpu-total",
                    "test_site": "testing",
                    "host": "172.16.241.111",
                    "host_ip": "172.16.241.111",
                    "name": "cpu",
                    "project": "demo-testing"
                }
            },
            {
                "columns": {
                    "time": 1744866103991,
                    "total": 10.37376049,
                    "user": 7.17009916
                },
                "tags": {
                    "cpu": "cpu-total",
                    "test_site": "testing",
                    "host": "172.16.241.111",
                    "host_ip": "172.16.241.111",
                    "name": "cpu",
                    "project": "demo-testing"
                }
            }
        ],
        [
            {
                "columns": {
                    "time": 1744866107975,
                    "total": 21.75562864,
                    "user": 5.69187959
                },
                "tags": {
                    "cpu": "cpu-total",
                    "test_site": "testing",
                    "host": "172.16.242.112",
                    "host_ip": "172.16.242.112",
                    "name": "cpu",
                    "project": "demo-testing"
                }
            },
            {
                "columns": {
                    "time": 1744866102975,
                    "total": 16.59466328,
                    "user": 5.28589581
                },
                "tags": {
                    "cpu": "cpu-total",
                    "test_site": "testing",
                    "host": "172.16.242.112",
                    "host_ip": "172.16.242.112",
                    "name": "cpu",
                    "project": "demo-testing"
                }
            }
        ]
    ],
    "status_code": 200
}

`dql_series_get`¶

Function prototype: fn dql_series_get(series: map, name: str) -> list

Function description: get series data

Function parameters:

series: dql query result
name: column or tag name

Function return value:

list: specified column or tag value for the series

Function examples:

Example 0:

Script content:

v = dql("M::cpu limit 2 slimit 2") 

hostLi = dql_series_get(v, "host")
time_li = dql_series_get(v, "time")

printf("%v", {"host": hostLi, "time": time_li})

Standard output:

{"host":[["172.16.241.111","172.16.241.111"],["172.16.242.112","172.16.242.112"]],"time":[[1744866108991,1744866103991],[1744866107975,1744866102975]]}

`dql_timerange_get`¶

Function prototype: fn dql_timerange_get() -> list

Function description: Get the time range of the DQL query, which is passed in by the script caller or defaults to the last 15 minutes.

Function return value:

list: The time range. For example, [1744214400000, 1744218000000], the timestamp precision is milliseconds

Function examples:

Example 0:

Script content:

val = dql_timerange_get()
printf("%v", val)

Standard output:

[1672531500000,1672532100000]

Example 1:

Script content:

val = dql_timerange_get()
printf("%v", val)

Standard output:

[1672531200000,1672532100000]

`dump_json`¶

Function prototype: fn dump_json(v: str, indent: str = "") -> (str, bool)

Function description: Returns the JSON encoding of v.

Function parameters:

v: Object to encode.
indent: Indentation prefix.

Function return value:

str: JSON encoding of v.
bool: Whether decoding is successful.

Function examples:

Example 0:

Script content:

v = {"a": 1, "b": 2.1}
v, ok = dump_json(v)
if ok {
    printf("%v", v)
}

Standard output:

{"a":1,"b":2.1}

Example 1:

Script content:

v = {"a": 1, "b": 2.1}
v, ok = dump_json(v, "  ")
if ok {
    printf("%v", v)
}

Standard output:

{
  "a": 1,
  "b": 2.1
}

`exit`¶

Function prototype: fn exit()

Function description: Exit the program

Function examples:

Example 0:

Script content:

printf("1\n")
printf("2\n")
exit()
printf("3\n")

Standard output:

1
2

`format_int`¶

Function prototype: fn format_int(val: int, base: int) -> str

Function description: Formats an integer into a string.

Function parameters:

val: The integer to format.
base: The base to use for formatting. Must be between 2 and 36.

Function return value:

str: The formatted string.

Function examples:

Example 0:

Script content:

v = format_int(16, 16)
printf("%s", v)

Standard output:

`geoip`¶

Function prototype: fn geoip(ip: str) -> map

Function description: GeoIP

Function parameters:

ip: IP address.

Function return value:

map: IP geographical information.

Function examples:

Example 0:

Script content:

v = geoip("127.0.0.1")
printf("%v", v)

Standard output:

{"city":"","country":"","isp":"unknown","province":""}

Example 1:

Script content:

ip_addr = "114.114.114.114"
v, ok = dump_json(geoip(ip_addr), "    ");
if ok {
    printf("%v", v)
}

Standard output:

 {
    "city": "Ji'an",
    "country": "CN",
    "isp": "chinanet",
    "province": "Jiangxi"
}

`gjson`¶

Function description: GJSON provides a fast and easy way to get values from a JSON document.

Function parameters:

input: JSON format string to parse.
json_path: JSON path.

Function return value:

bool|int|float|str|list|map: Parsed result.
bool: Parsed status.

Function examples:

Example 0:

Script content:

v='''{
    "name": {"first": "Tom", "last": "Anderson"},
    "age": 37,
    "children": ["Sara","Alex","Jack"],
    "fav.movie": "Deer Hunter",
    "friends": [
        {"first": "Dale", "last": "Murphy", "age": 44, "nets": ["ig", "fb", "tw"]},
        {"first": "Roger", "last": "Craig", "age": 68, "nets": ["fb", "tw"]},
        {"first": "Jane", "last": "Murphy", "age": 47, "nets": ["ig", "tw"]}
    ]
}'''
age, ok = gjson(v, "age")
if ok {
    printf("%.0f", age)
} else {
    printf("not found")
}

Standard output:

Example 1:

Script content:

v='''{
    "name": {"first": "Tom", "last": "Anderson"},
    "age": 37,
    "children": ["Sara","Alex","Jack"],
    "fav.movie": "Deer Hunter",
    "friends": [
        {"first": "Dale", "last": "Murphy", "age": 44, "nets": ["ig", "fb", "tw"]},
        {"first": "Roger", "last": "Craig", "age": 68, "nets": ["fb", "tw"]},
        {"first": "Jane", "last": "Murphy", "age": 47, "nets": ["ig", "tw"]}
    ]
}'''
name, ok = gjson(v, "name")
printf("%v", name)

Standard output:

{"first": "Tom", "last": "Anderson"}

Example 2:

Script content:

v='''[
    {"first": "Dale", "last": "Murphy", "age": 44, "nets": ["ig", "fb", "tw"]},
    {"first": "Roger", "last": "Craig", "age": 68, "nets": ["fb", "tw"]},
    {"first": "Jane", "last": "Murphy", "age": 47, "nets": ["ig", "tw"]}
]'''
net, ok = gjson(v, "0.nets.2")
printf("%v", net)

Standard output:

tw

`grok`¶

Function prototype: fn grok(input: str, pattern: str, extra_patterns: map = {}, trim_space: bool = true) -> (map, bool)

Function description: Extracts data from a string using a Grok pattern. Grok is based on regular expression syntax, and using regular (named) capture groups in a pattern is equivalent to using a pattern in a pattern. A valid regular expression is also a valid Grok pattern.

Function parameters:

input: The input string used to extract data.
pattern: The pattern used to extract data.
extra_patterns: Additional patterns for parsing patterns.
trim_space: Whether to trim leading and trailing spaces from the parsed value.

Function return value:

map: The parsed result.
bool: Whether the parsing was successful.

Function examples:

Example 0:

Script content:

```txt app_log="2021-01-11T17:43:51.887+0800 DEBUG io io/io.go:458 post cost 6.87021ms"

Use built-in patterns, named capture groups, custom patterns, extract fields;¶

convert the type of the extracted field by specifying the type.¶

v, ok = grok( app_log, "%{TIMESTAMP_ISO8601:log_time}\s+(?P[a-zA-Z]+)\s+%{WORD}\s+%{log_code_pos_pattern:log_code_pos}.*\s%{NUMBER:log_cost:float}ms", { "log_code_pos_pattern": "[a-zA-Z0

Arbiter Built-in Functions¶

append¶

b64dec¶

b64enc¶

call_func¶

cast¶

cidr¶

delete¶

dql¶

dql_series_get¶

dql_timerange_get¶

dump_json¶

exit¶

format_int¶

geoip¶

gjson¶

grok¶

Use built-in patterns, named capture groups, custom patterns, extract fields;¶

convert the type of the extracted field by specifying the type.¶

Is this page helpful? ×

`append`¶

`b64dec`¶

`b64enc`¶

`call_func`¶

`cast`¶

`cidr`¶

`delete`¶

`dql`¶

`dql_series_get`¶

`dql_timerange_get`¶

`dump_json`¶

`exit`¶

`format_int`¶

`geoip`¶

`gjson`¶

`grok`¶