Count Of

Search

Synopsis

Writes the number of times a substring occurs within a string field into a target field.

Schema

- count_of:
    field: <ident>
    substring: <string>
    description: <text>
    if: <script>
    ignore_failure: <boolean>
    ignore_missing: <boolean>
    on_failure: <processor[]>
    on_success: <processor[]>
    tag: <string>
    target_field: <ident>

Configuration

The following fields are used to define the processor:

Field	Required	Default	Description
field	Y	-	Field containing the string to search
substring	Y	-	Text to count. Supports templates, so it can be built from another field. Must not be empty
description	N	-	Explanatory note
if	N	-	Condition to run
ignore_failure	N	false	See Handling Failures
ignore_missing	N	false	If true, quietly exit if field doesn't exist
on_failure	N	-	See Handling Failures
on_success	N	-	See Handling Success
tag	N	-	Identifier
disabled	N	false	When true, the processor is skipped and the event continues to the next one. Lets you take a processor out of the path without removing its configuration
target_field	N	field	Field to store the count. Defaults to field, replacing the string that was searched

Details

Matches are counted with overlap. The scan advances one position at a time rather than skipping past each match, so "aaaa" contains three occurrences of "aa", not two. This is the opposite of Index Of, whose plain-text scan is non-overlapping — the two processors deliberately differ, so do not infer one from the other.

An empty substring is an error rather than a count of every position.

The field must hold a string. An array, a number or an object fails.

note

target_field defaults to field, which replaces the string you searched with a number. Set it explicitly whenever the original is still needed.

Examples

Counting a Delimiter

Counting path segments by counting separators...	{ "path": "/var/log/app/error.log" } - count_of: field: path substring: "/" target_field: depth
leaving the path intact:	{ "path": "/var/log/app/error.log", "depth": 4 }

Overlapping Matches

Matches may overlap, so each starting position is counted...	{ "sample": "aaaa" } - count_of: field: sample substring: "aa" target_field: pairs
giving three rather than two:	{ "sample": "aaaa", "pairs": 3 }

No Match

A substring that never occurs counts zero rather than failing...	{ "message": "connection established" } - count_of: field: message substring: "error" target_field: error_count
so the result is always a number:	{ "message": "connection established", "error_count": 0 }