Guide / Expression reference

Expression reference

Operators

Comparisons work on numbers, strings and booleans. Mixed-type comparisons are an error under --strict and evaluate to false otherwise.

.level == "error"
.status >= 500 and .dur_ms > 250
.path startswith "/api/" and not .cached
.tags contains "billing"

Precedence is the obvious one: comparisons bind tighter than not, which binds tighter than and, which binds tighter than or. Parentheses work where you expect.

Built-in functions

len(x)

Length of a string or array. Returns 0 for missing fields rather than raising, which makes it safe in comparisons.

lower(s)

Lowercases a string. Non-strings pass through unchanged.

has(k)

True when the record contains key k, even if its value is null. Use this to tell "absent" apart from "explicitly null".

age(t)

Seconds between the timestamp field and now. Accepts RFC 3339 and unix epoch, in seconds or milliseconds.

Exit codes

0   at least one line matched
1   no lines matched
2   expression failed to parse
3   input error (broken pipe, unreadable file)

The split between 0 and 1 is deliberate, so sift ... && notify does the right thing in a cron job.

Changelog

• 0.9.3Fix --since off-by-one on records without a timestamp field.
• 0.9.2--count no longer buffers the whole stream before printing.
• 0.9.1Allow bare field names as truthiness checks: sift '.cached'.
• 0.9.0First public build. Expression syntax is stable from here.