Allow filtering on missing variables

[RealOrangeOne]

Especially useful when parsing lines of different structures with logfmt, it's useful to say something like "only use lines where this variable exists", or something.

This could be something where missing variables are falsy, so using where would work as normal. Or perhaps a different operator, or a new filter entirely (eg has). For an intuitive feel, making them falsey, or never equal to anything in a where would be really nice, although may not be backwards compatible.

Currently I add a contains before logfmt, which feels like a bit of a hack.

Example

type=event value=50
path=/ response_time=50ms

Using | where value > 50 would result in an error for the second line. Whereas being able to do | has value before it would filter out any of those.

[rcoh]

Yeah this is a good idea. I would make a unary function called has: ``` | where has(foo) | where foo > 50 ```

…

On Wed, Jun 16, 2021, 2:18 PM Jake Howard ***@***.***> wrote: Especially useful when parsing lines of different structures with logfmt, it's useful to say something like "only use lines where this variable exists", or something. This could be something where missing variables are falsy, so using where would work as normal. Or perhaps a different operator, or a new filter entirely (eg has). For an intuitive feel, making them falsey, or never equal to anything in a where would be really nice, although may not be backwards compatible. Currently I add a contains before logfmt, which feels like a bit of a hack. Example type=event value=50 path=/ response_time=50ms Using | where value > 50 would result in an error for the second line. Whereas being able to do | has value before it would filter out any of those. — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub <#140>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AADYKZ3SCXYLUKQ5PNUD3RTTTEIJDANCNFSM462JCGEQ> .