Conversion operators

dectohex

Converts a decimal (base-10) integer to its hexadecimal (base-16) string representation. Use dectohex to transform numeric fields — such as HTTP status codes or port numbers — into hex for display, correlation with hex-encoded identifiers, or protocol-level debugging.

Syntax

| dectohex(<longField>) as <alias>

Parameters

Example

Convert HTTP status codes parsed from nginx logs to their hexadecimal equivalents.

source="nginx"
| parse "* - - [*] \"* *\" * * *" as ip,date,method,url,status,bytes,rest
| dectohex(status) as status_hex
| first(status_hex) by status

hextoascii

Converts a hexadecimal string to its ASCII text representation by interpreting each pair of hex characters as a byte. Use hextoascii to decode hex-encoded payloads, tokens, or message bodies that appear in log fields as raw hex strings.

Syntax

| hextoascii(<hexString>) as <alias>

Parameters

Example

Decode a known hex-encoded string to verify the ASCII output.

source="nginx"
| parse "* - - [*] \"* *\" * * *" as ip,date,method,url,status,bytes,rest
| hextoascii("48656c6c6f") as decoded
| first(decoded) by method

hextodec

Converts a hexadecimal (base-16) string to its decimal (base-10) integer value. Use hextodec to decode hex-encoded identifiers, status codes, or addresses that appear in log fields before performing arithmetic or numeric comparisons.

Syntax

| hextodec(<hexString>) as <alias>

Parameters

Example

Convert hex status code strings back to their decimal equivalents.

source="nginx"
| parse "* - - [*] \"* *\" * * *" as ip,date,method,url,status,bytes,rest
| dectohex(status) as status_hex
| hextodec(status_hex) as status_dec
| first(status_dec) by status

tobytes

Converts a human-readable storage size string (such as 1.5KB or 2MB) into the equivalent number of bytes as an integer. Use tobytes to normalize size fields that arrive in mixed units before aggregating or comparing them.

Syntax

| tobytes(<storageSize>) as <alias>

Parameters

Example

Convert a static size string of 2MB to its byte equivalent.

source="nginx"
| parse "* - - [*] \"* *\" * * *" as ip,date,method,url,status,bytes,rest
| tobytes("2MB") as size_bytes
| first(size_bytes) by method

toduration

Converts a string representation of a time duration to its value in milliseconds. Supported unit suffixes are ns (nanoseconds), µs or us (microseconds), ms (milliseconds), s (seconds), m (minutes), and h (hours). Use toduration to normalize latency or elapsed-time fields before aggregating them — for example, converting response durations extracted from application logs.

Syntax

| toduration(<timeString>) as <alias>

Parameters

Example

Extract duration values from query-service logs and compute the average latency in milliseconds.

source="query-service"
| parse "* duration=*ms*" as pre,duration_ms,post
| toduration(duration_ms) as dur_num
| avg(dur_num) as avg_ms

tofloat

Parses a string representation of a number, or an integer, to a floating-point value. Use tofloat when a field is stored as a string but must be treated as a float for precise arithmetic or aggregation — for example, converting response times or byte counts before computing averages.

Syntax

| tofloat(<number>) as <alias>
| tofloat(<numberString>) as <alias>

Parameters

Example

Convert the bytes field parsed from nginx logs to a float and compute the average response size per HTTP method.

source="nginx"
| parse "* - - [*] \"* *\" * * *" as ip,date,method,url,status,bytes,rest
| tofloat(bytes) as bytes_float
| avg(bytes_float) as avg_bytes by method

toint

Parses a string representation of a number, or a floating-point number, to an integer by truncating the decimal portion. Use toint when a field is stored as a string but must be treated as an integer for arithmetic, comparison, or aggregation — for example, converting the bytes field parsed from nginx logs before computing averages.

Syntax

| toint(<number>) as <alias>
| toint(<numberString>) as <alias>

Parameters

Example

Convert the bytes field parsed from nginx logs to an integer and compute the average response size per HTTP method.

source="nginx"
| parse "* - - [*] \"* *\" * * *" as ip,date,method,url,status,bytes,rest
| toint(bytes) as bytes_int
| avg(bytes_int) as avg_bytes by method