With the introduction of format strings to TQL, this release makes string construction from multiple parts easier than ever before.
Download the release on GitHub.
Features
Section titled “Features”Format strings
Section titled “Format strings”TQL now supports format strings as you might know them from other languages like
Python. Format strings allow you to flexibly construct strings in a very
succinct way by using a pair of braces within an f"…" string.
For example, assume that you have events with two integer fields, found and
total. We can construct a message from this as follows:
percent = round(found / total * 100).string()message = "Found " + found.string() + "/" + total.string() + " => " + percent + "%"Using the new format strings, this simply becomes
percent = round(found / total * 100)message = f"Found {found}/{total} => {percent}%"You can also use arbitrary expressions inside { to simplify this even further:
message = f"Found {found}/{total} => {round(found / total * 100)}%"If you ever need an actual { in your format string, you can use {{. The same
goes for the closing brace }, which needs to be written as }} within format
strings.
By @jachris, @IyeOnline in #5254.
Changes
Section titled “Changes”Remove meta keyword
Section titled “Remove meta keyword”The identifier meta is no longer a keyword and can thus now be used as a
normal field name.
Bug Fixes
Section titled “Bug Fixes”Gracefully handle null values when charting with resolution
Section titled “Gracefully handle null values when charting with resolution”The chart_bar and chart_pie operators had a bug when the x-axis had a
null value and the resolution option was specified. The unfortunate panic
due to this bug has now been fixed.
Pipeline activity refresh without running pipelines
Section titled “Pipeline activity refresh without running pipelines”The pipeline::activity operator now always yields new events, even when all
running pipelines are hidden.
Invalid scientific notation when using write_json
Section titled “Invalid scientific notation when using write_json”When using write_json with large floating-point numbers, the resulting JSON
was ill-formed. For example, the number 5483819555176798000.0 was previously
printed as 5.483819555176798e+18.0. The extra .0 at the end is not valid
JSON. Thus, the output was rejected by some parsers. Now, write_json renders
this number as 5.483819555176798e+18 instead.
This bug was also observable on the Tenzir Platform, where it could lead to request timeouts. Now, large numbers are shown correctly.
Unreliable where diagnostics
Section titled “Unreliable where diagnostics”The where operator now correctly produces diagnostics also for simple
expressions, which was previously not the case in some situations.