FilterFromArgs given set of values.

UrlWithQueryEval pass reg-expressions to match qs args.

All Answers True/False if all of the arguments evaluate to truish (javascripty) type definintion of true.

Any Answers True/False if any of the arguments evaluate to truish (javascripty) type definintion of true Rules for if True: int != 0 string != "" boolean natively supported true/false time != time.IsZero() Examples: any(item,item2) => true, true any(not_field) => false, true.

ArrayIndex array.index choose the nth element of an array // given context input of "items" = [1,2,3] array.index(items, 1) => 1, true array.index(items, 5) => nil, false array.index(items, -1) => 3, true .

array.slice slice element m -> n of a slice.

Avg average of values.

Cast type coercion, cast to an explicit type.

Contains does first arg string contain 2nd arg? contains("alabama","red") => false .

Count Return int value 1 if non-nil/zero.

DayOfWeek day of week [0-6] dayofweek() => 3, true dayofweek("2016/07/04") => 5, true .

Extract Domain from a Value, or Values (must be urlish), doesn't do much/any validation.

Domains Extract Domains from a Value, or Values (must be urlish), doesn't do much/any validation domains("http://www.lytics.io/index.html") => []string{"lytics.io"} .

email a string, parses email and makes sure it is valid email("Bob <[email protected]>") => [email protected], true email("Bob <bob>") => "", false .

emaildomain parses email and returns domain emaildomain("Bob <[email protected]>") => bob.com .

emailname a string, parses email emailname("Bob <[email protected]>") => Bob .

Base 64 encoding function encoding.b64decode("aGVsbG8gd29ybGQ=") => "hello world" .

Base 64 encoding function encoding.b64encode("hello world=") => aGVsbG8gd29ybGQ= .

Equal function? returns true if items are equal // given context {"name":"wil","event":"stuff", "int4": 4} eq(int4,5) => false .

Exists Answers True/False if the field exists and is non null exists(real_field) => true exists("value") => true exists("") => false exists(empty_field) => false exists(2) => true exists(todate(date_field)) => true .

Filter Filter OUT Values that match specified list of match filter criteria Operates on MapValue (map[string]interface{}), StringsValue ([]string), or string takes N Filter Criteria supports Matching: "filter**" // matches "filter_x", "filterstuff" Filter a map of values by key to remove certain keys filter(match("topic_"),key_to_filter, key2_to_filter) => {"goodkey": 22}, true Filter out VALUES (not keys) from a list of []string{} for a specific value filter(split("apples,oranges",","),"ora*") => ["apples"], true Filter out values for single strings filter("apples","app*") => []string{}, true .

FilterMatch Filter IN Values that match specified list of match filter criteria Operates on MapValue (map[string]interface{}), StringsValue ([]string), or string takes N Filter Criteria Wildcard Matching: "abcd*" // matches "abcd_x", "abcdstuff" Filter a map of values by key to only keep certain keys filtermatch(match("topic_"),key_to_filter, key2_to_filter) => {"goodkey": 22}, true Filter in VALUES (not keys) from a list of []string{} for a specific value filtermatch(split("apples,oranges",","),"ora*") => ["oranges"], true Filter in values for single strings filtermatch("apples","app*") => []string{"apple"}, true .

Ge GreaterThan or Equal func.

Gt GreaterThan is left hand > right hand.

HashMd5Func Hash a value to MD5 string hash.md5("/blog/index.html") => abc345xyz .

HashSha1Func Hash a value to SHA256 string hash.sha1("/blog/index.html") => abc345xyz .

HashSha256Func Hash a value to SHA256 string hash.sha256("/blog/index.html") => abc345xyz .

HashSha512Func Hash a value to SHA512 string hash.sha512("/blog/index.html") => abc345xyz .

hash.sip() hash a value to a 64 bit int hash.sip("/blog/index.html") => 1234 .

HasPrefix string evaluation to see if string begins with hasprefix("apples","ap") => true hasprefix("apples","o") => false .

HasSuffix string evaluation to see if string ends with hassuffix("apples","es") => true hassuffix("apples","e") => false .

Extract host from a String (must be urlish), doesn't do much/any validation In the event the value contains more than one input url, will ONLY evaluate first host("http://www.lytics.io/index.html") => www.lytics.io .

Extract hosts from a Strings (must be urlish), doesn't do much/any validation hosts("http://www.lytics.io", "http://www.activate.lytics.io") => www.lytics.io, www.activate.lytics.io .

hourofday hour of day [0-23] hourofday(field) hourofday() // Uses message time .

hour of week [0-167].

Join items together (string concatenation) join("apples","oranges",",") => "apples,oranges" join(["apples","oranges"],",") => "apples,oranges" join("apples","oranges","") => "applesoranges" .

JsonPath jmespath json parser http://jmespath.org/ json_field = `[{"name":"n1","ct":8,"b":true, "tags":["a","b"]},{"name":"n2","ct":10,"b": false, "tags":["a","b"]}]` json.jmespath(json_field, "[?name == 'n1'].name | [0]") => "n1" .

Le Less Than or Equal.

len length of array types len([1,2,3]) => 3, true len(not_a_field) => -- NilInt, false .

LowerCase take a string and lowercase it.

Lt Less Than Must be able to convert items to Floats lt(5, 6) => true .

Map Create a map from two values.

MapInvert: Take a map and invert key/values // given input: tags = {"1":"news","2":"sports"} mapinvert(tags) => map[string]string{"news":"1","sports":"2"} .

MapKeys: Take a map and extract array of keys //given input: {"tag.1":"news","tag.2":"sports"} mapkeys(match("tag.")) => []string{"news","sports"} .

MapTime() Create a map[string]time of each key maptime(field) => map[string]time{field_value:message_timestamp} maptime(field, timestamp) => map[string]time{field_value:timestamp} .

MapValues: Take a map and extract array of values // given input: {"tag.1":"news","tag.2":"sports"} mapvalue(match("tag.")) => []string{"1","2"} .

Match a simple pattern match on KEYS (not values) and build a map of all matched values.

mm Get month as integer from date @optional timestamp (if not, gets from context reader) mm() => 01, true /// assuming message ts = jan 1 mm("2014-03-17") => 03, true .

Ne Not Equal function? returns true if items are equal // given {"5s":"5","item4":4,"item4s":"4"} ne(`5s`,5) => true, true ne(`not_a_field`,5) => false, true ne(`item4s`,5) => false, true ne(`item4`,5) => false, true .

Not urnary negation function not(eq(5,5)) => false, true not(eq("false")) => false, true .

Now Get current time of Message (message time stamp) or else choose current server time if none is available in message context .

OneOf choose the first non-nil, non-zero, non-false fields oneof(nil, 0, "hello") => 'hello' .

Pow exponents, raise x to the power of y pow(5,2) => 25, true pow(3,2) => 9, true pow(not_number,2) => NilNumber, false .

Qs Extract qs param from a string (must be url valid) qs("http://www.lytics.io/?utm_source=google","utm_source") => "google", true .

Qs Extract qs param from a string (must be url valid) qs("http://www.lytics.io/?utm_source=google","utm_source") => "google", true .

Replace a string(s).

Split a string with given separator split("apples,oranges", ",") => []string{"apples","oranges"} .

Sqrt square root function.

StrFromTime extraces certain parts from a time, similar to Python's StrfTime See http://strftime.org/ for Strftime directives.

StringIndex a string, removing leading/trailing whitespace string.index("apples, oranges ", ",") => 6 string.index("apples, oranges ", "X") => -1, false .

Strip a string, removing leading/trailing whitespace strip(split("apples, oranges ",",")) => {"apples", "oranges"} strip("apples ") => "apples" .

SubString from a given string, use integers to describe the start, [stop] of substring to extract.

Sum function to add values.

TimeSeconds time in Seconds, parses a variety of formats looking for seconds See github.com/araddon/dateparse for formats supported on date parsing seconds("M10:30") => 630 seconds("M100:30") => 6030 seconds("00:30") => 30 seconds("30") => 30 seconds(30) => 30 seconds("2015/07/04") => 1435968000 .

UnixDateTruncFunc converts a value.Value to a unix timestamp string.

TitleCase take a string and uppercase it.

ToBool cast as boolean .

todate: convert to Date // uses lytics/datemath todate("now-3m") // uses araddon/dateparse util to recognize formats todate(field) // first parameter is the layout/format todate("01/02/2006", field ) .

todatein: convert to Date with timezon // uses lytics/datemath todate("now-3m", "America/Los_Angeles") // uses araddon/dateparse util to recognize formats todate(field, "America/Los_Angeles") .

ToInt Convert to Integer: Best attempt at converting to integer.

ToNumber Convert to Number: Best attempt at converting to integer tonumber("5") => 5.0 tonumber("5.75") => 5.75 tonumber("5,555") => 5555 tonumber("$5") => 5.00 tonumber("5,555.00") => 5555 .

ToString cast as string.

totimestamp: convert to date, then to unix Seconds totimestamp() => int, true totimestamp("Apr 7, 2014 4:58:55 PM") => 1396889935 .

Unsign converts a signed int to an unsigned int represented as a string for positive numbers this should simply convert the number to a string for negative numbers, converting to a uint adds the negative value to the max uint value (18446744073709551615).

UpperCase take a string and uppercase it.

url decode a string urldecode("http://www.lytics.io/index.html") => http://www.lytics.io In the event the value contains more than one input url, will ONLY evaluate first .

UrlMain remove the querystring and scheme from url urlmain("http://www.lytics.io/?utm_source=google") => "www.lytics.io/", true .

UrlMinusQs removes a specific query parameter and its value from a url urlminusqs("http://www.lytics.io/?q1=google&q2=123", "q1") => "http://www.lytics.io/?q2=123", true .

UrlPath Extract url path from a String (must be urlish), doesn't do much/any validation path("http://www.lytics.io/blog/index.html") => blog/index.html In the event the value contains more than one input url, will ONLY evaluate first .

UrlWithQueryFunc strips a url and retains only url parameters that match the supplied regular expressions.

UserAgent Extract user agent features useragent(user_agent_field,"mobile") => "true", true .

UserAgentMap Extract user agent features useragent.map(user_agent_field) => {"mobile": "false","platform":"X11"}, true .

uuid generates a new uuid uuid() => "...." .

Yy Get year in integer from field, must be able to convert to date yy() => 15, true // assuming it is 2015 yy("2014-03-01") => 14, true .

yymm convert date to 4 digit string from argument if supplied, else uses message context ts yymm() => "1707", true yymm("2016/07/04") => "1607", true .