Event field data types

Modified on Wed, 29 May 2024 at 09:34 PM

When using Advanced Query to analyze Events stored in the data lake, it is sometimes necessary to be aware of the data types of the fields of the records being processed.

For instance if you want to perform a numeric comparison on the value of a field, you need to ensure that it has a numerical data type (such as an integer) or otherwise type-cast it first.  For instance, in the following example, we are testing for privileged port numbers (below 1024), but the dest_port field is a string:

events
where  product == "VPC Flow Logs"
 and toint(dest_port) < 1024

Here we are using the toint() statement to convert the dest_port field to an integer before making a numerical comparison.

This raises the question of how to determine the data types of fields.  You can use the getschema  statement to display the data types of fields.  The following query will display the types of the fields of the entire schema:

events  | getschema

This example produces output something like this:

mceclip0.png

 

To find the type of a specific field, you can use the search bar above the output:

mceclip1.png

This example selects all the fields whose names contain the substring "port".

If you know the name of the field whose type you want to query, you can use the project statement to filter out only that field:

mceclip2.png