eval

The eval command evaluates the specified expression and appends the result of the evaluation to the search results.

The eval command processes data after documents are retrieved from the shards. This means that eval cannot be used to filter documents before they are returned. Use a where clause for filtering. Additionally, because eval computations are performed on the coordinating node rather than distributed across data nodes, performance may be slower for large result sets.

The eval command is not rewritten to query domain-specific language (DSL). It is only executed on the coordinating node.

Syntax

The eval command has the following syntax:

eval <field>=<expression> ["," <field>=<expression> ]...

Parameters

The eval command supports the following parameters.

Example 1: Classifying logs by severity tier

The following query creates an is_critical field that classifies each log as critical or non-critical based on severity, useful for building alert rules:

source=otellogs
| eval is_critical = IF(severityNumber >= 17, 'yes', 'no')
| dedup severityText
| sort severityNumber
| fields severityText, is_critical

The query returns the following results:

Example 2: Finding untraced errors

The following query creates two boolean fields to identify error logs and whether they have distributed tracing context. Untraced errors are harder to debug because you can’t follow the request across services:

source=otellogs
| eval is_error = severityNumber >= 17, is_traced = LENGTH(traceId) > 0
| where is_error = true
| sort `resource.attributes.service.name`
| fields `resource.attributes.service.name`, is_error, is_traced

The query returns the following results:

Example 3: Building a standardized log line

The following query prepends the severity level to the log body, creating a standardized format for export or alerting:

source=otellogs
| where severityText IN ('ERROR', 'WARN')
| eval formatted = '[' + severityText + '] ' + body
| sort severityNumber, `resource.attributes.service.name`
| fields formatted
| head 3

The query returns the following results: