diff --git a/docs/VictoriaLogs/CHANGELOG.md b/docs/VictoriaLogs/CHANGELOG.md index d8412653e..b756ecd17 100644 --- a/docs/VictoriaLogs/CHANGELOG.md +++ b/docs/VictoriaLogs/CHANGELOG.md @@ -19,6 +19,8 @@ according to [these docs](https://docs.victoriametrics.com/VictoriaLogs/QuickSta ## tip +* FEATURE: add ability to extract fields only if the given condition is met. See [these docs](https://docs.victoriametrics.com/victorialogs/logsql/#conditional-extract). + ## [v0.8.0](https://github.com/VictoriaMetrics/VictoriaMetrics/releases/tag/v0.8.0-victorialogs) Released at 2024-05-20 diff --git a/docs/VictoriaLogs/LogsQL.md b/docs/VictoriaLogs/LogsQL.md index fda35eca6..df74d88a7 100644 --- a/docs/VictoriaLogs/LogsQL.md +++ b/docs/VictoriaLogs/LogsQL.md @@ -1135,10 +1135,21 @@ _time:1d error | extract "ip= " | stats by (ip) count() logs | sort by (logs See also: -- [format for extract pipe pattern](#format-for-extract-pipe-pattern) +- [Format for extract pipe pattern](#format-for-extract-pipe-pattern) +- [Conditional extract](#conditional-extract) - [`unpack_json` pipe](#unpack_json-pipe) - [`unpack_logfmt` pipe](#unpack_logfmt-pipe) +#### Conditional extract + +Sometimes it is needed to skip some entries from applying [`extract` pipe](#extract-pipe). This can be done by adding `if ()` filter to the end of `| extract ...` pipe. +The `` can contain arbitrary [filters](#filters). For example, the following query extracts `ip` field only +if the input [log entry](https://docs.victoriametrics.com/VictoriaLogs/keyConcepts.html#data-model) doesn't contain `ip` field or this field is empty: + +```logsql +_time:5m | extract "ip= " if (ip:"") +``` + #### Format for extract pipe pattern The `pattern` part from [`| extract from src_field "pattern"` pipe](#extract-pipes) may contain arbitrary text, which matches as is to the `src_field` value.