Max
Synopsis
Calculates the maximum value between two numeric operands.
Schema
- max:
field: <ident>
left_operand: <string>
right_operand: <string>
description: <text>
if: <script>
ignore_failure: <boolean>
ignore_missing: <boolean>
on_failure: <processor[]>
on_success: <processor[]>
tag: <string>
Configuration
The following fields are used to define the processor:
Field | Required | Default | Description |
---|---|---|---|
field | Y | - | Target field to store the maximum value |
left_operand | Y | - | First value to compare - can be a literal value or field reference |
right_operand | Y | - | Second value to compare - can be a literal value or field reference |
description | N | - | Explanatory note |
if | N | - | Condition to run |
ignore_failure | N | false | Continue processing if comparison fails |
ignore_missing | N | false | Skip if referenced fields don't exist |
on_failure | N | - | Error handling processors |
on_success | N | - | Success handling processors |
tag | N | - | Identifier |
Details
Compares two numeric values and stores the larger value in the target field. The processor can use literal values or extract values from existing fields in the log entry.
Numeric values are automatically converted to appropriate types for comparison. The processor accepts both literal values and field references for operands.
The processor is useful for finding maximum values, implementing ceiling functions, and ensuring values don't fall below thresholds.
If either operand cannot be converted to a number, the processor will fail unless ignore_failure
is set to true
. Always ensure inputs are valid numbers or provide proper error handling.
Examples
Basic
Comparing two literal values... |
|
stores the larger value: |
|
Field-Based
Finding maximum between field values... |
|
compares multiple values: |
|
Thresholds
Ensuring value doesn't fall below threshold... |
|
enforces minimum allocation: |
|
Mixed Types
Comparing values of different types... |
|
handles automatic type conversion: |
|