Subtract

Arithmetic Data Analysis

Synopsis

Subtracts one numeric value from another.

- subtract:
    field: <ident>
    left_operand: <string>
    right_operand: <string>
    description: <text>
    if: <script>
    ignore_failure: <boolean>
    ignore_missing: <boolean>
    on_failure: <processor[]>
    on_success: <processor[]>
    tag: <string>

Configuration

The following fields are used to define the processor:

Field	Required	Default	Description
field	Y	-	Target field to store the subtraction result
left_operand	Y	-	Minuend (value to subtract from) - can be a literal value or field reference
right_operand	Y	-	Subtrahend (value to be subtracted) - can be a literal value or field reference
description	N	-	Explanatory note
if	N	-	Condition to run
ignore_failure	N	false	Continue processing if subtraction fails
ignore_missing	N	false	Replace missing operands with 0 instead of failing
on_failure	N	-	Error handling processors
on_success	N	-	Success handling processors
tag	N	-	Identifier

Details

Subtracts the right operand from the left operand and stores the result in the target field. The processor can use literal values or extract values from existing fields in the log entry.

note

Numeric values are automatically converted to appropriate types for subtraction. The processor accepts both literal values and field references for operands.

The processor is useful for calculating differences, performing adjustments, implementing mathematical operations, and deriving new metrics from existing values.

warning

When ignore_missing is set to true, the processor will replace any missing fields with 0 instead of failing. This can lead to unexpected results if you're not careful, as missing fields will be treated as having a value of 0 in the calculation.

Examples

Basic

Subtracting two literal values...	{ "calculation": {} } - subtract: field: calculation.result left_operand: "100" right_operand: "42"
calculates and stores the result:	{ "calculation": { "result": 58 } }

Field-Based

Calculating difference between field values...	{ "timestamps": { "start": 1625136000, "end": 1625139600 } } - subtract: field: timestamps.duration left_operand: "timestamps.end" right_operand: "timestamps.start"
computes time duration:	{ "timestamps": { "start": 1625136000, "end": 1625139600, "duration": 3600 } }

Delta

Calculating change in metric values...	{ "metrics": { "current": { "cpu_usage": 72.5 }, "previous": { "cpu_usage": 65.3 } } } - subtract: field: metrics.cpu_usage_delta left_operand: "metrics.current.cpu_usage" right_operand: "metrics.previous.cpu_usage"
determines the rate of change:	{ "metrics": { "current": { "cpu_usage": 72.5 }, "previous": { "cpu_usage": 65.3 }, "cpu_usage_delta": 7.2 } }

Mixed Types

Working with different data types...	{ "balance": { "total": "1000", "charges": 123.45 } } - subtract: field: balance.remaining left_operand: "balance.total" right_operand: "balance.charges"
handles automatic type conversion:	{ "balance": { "total": "1000", "charges": 123.45, "remaining": 876.55 } }

Missing Fields

Processing with missing fields...	{ "accounting": { "credits": 500 } } - subtract: field: accounting.balance left_operand: "accounting.credits" right_operand: "accounting.debits" ignore_missing: true
treats them as zero:	{ "accounting": { "credits": 500, "balance": 500 } }

Chains

Performing sequential calculations...

{ "shopping": { "subtotal": 129.99, "tax_rate": 0.08, "discount": 15 } } - multiply: field: shopping.tax_amount left_operand: "shopping.subtotal" right_operand: "shopping.tax_rate" - add: field: shopping.total_with_tax left_operand: "shopping.subtotal" right_operand: "shopping.tax_amount" - subtract: field: shopping.final_price left_operand: "shopping.total_with_tax" right_operand: "shopping.discount"

builds a sequence of results:

{ "shopping": { "subtotal": 129.99, "tax_rate": 0.08, "discount": 15, "tax_amount": 10.3992, "total_with_tax": 140.3892, "final_price": 125.3892 } }