This topic describes the syntax and format of enrichment mapping functions, along with relevant scenario examples.

f_table_map function

The f_table_map function maps table data and returns the value of a specified field based on the given field name.

Function syntax/format

The parameters are described below:

Parameters	Parameter type	Required	Default value	Description
value	String	Yes	/	Target table. When you use the res_rds_mysql resource function as the data source, set the primary_keys parameter if possible to improve processing performance. For details, see res_rds_mysql function.
field	String	Yes	/	Source log field that is mapped to table data. Separate multiple fields with commas, such as "id,age". If the corresponding field does not exist in the log, this function will not perform any operation.
output_fields	String	Yes	/	The fields to be output after mapping. Multiple fields are separated with commas, such as "name,desc".
missing	String	No	/	Default value. When no matching field value is found, assign the value of the missing parameter to output_fields.
mode	String	No	overwrite	Field cover mode. Including: overwrite: If overwrite mode is selected, the field value will be overwritten. fill: If the target field does not exist or is empty, select fill mode to add a new field.

Function examples

Example 1

Scenario: Map to the table_tls table in the test_sql database on Volcanoengine MySQL. Return the values of name and desc fields based on the id and age fields.

Example 2

Scenario: Map to the table_tls table in the test_sql database on Volcanoengine MySQL. Return the values of name and desc fields based on id and age fields, and set the missing parameter to unknown.

f_dict_map function

The f_dict_map function maps an input field to a new field using a specified dictionary and its mapping relationships.

Function syntax/format

The parameters are described below:

Parameters	Parameter type	Required	Default value	Value range	Description
value	Dict	Yes	/	/	String dictionary used for mapping. Both key and value must be in string format.
fields	String	Yes	/	/	The name of a field or a list of field names. These field names are separated by commas. If multiple field names are specified: TLS will map the matched values in order. If multiple logs are matched and mode is set to overwrite, the last result will cover the previous ones. If no fields are matched, the value of the missing parameter will be used as the match value.
output_field	String	Yes	/	/	The name of output field.
missing	String	No	/	/	If there is no match for the default field, the value of this parameter will be assigned to the output field output_field. The default value None means no mapping or assignment operation will be performed.
mode	String	No	overwrite	overwrite fill	Specify the cover mode for the output field. overwrite: By default, always overwrite regardless of the condition. fill: Set the target field when the target field does not exist.

Function examples

Scenario: Map the status field in log content to the status_msg field using the mapping in dict.

f_dict_map(dict_make("200","success","400","parameter exception"),"status","status_msg","unknown status")