使用集合让一切井井有条
根据您的偏好保存内容并对其进行分类。
strings.coalesce
strings.coalesce(a, b, c, ...)
说明
此函数可接受任意数量的实参，并返回第一个计算结果不为空字符串（例如“非零值”）的表达式的值。如果所有实参的计算结果均为空字符串，则函数调用会返回一个空字符串。
参数可以是字面量、事件字段或函数调用。所有实参都必须是 STRING 类型。如果任何实参是事件字段，则这些属性必须来自同一事件。
形参数据类型
STRING
返回类型
STRING
代码示例
示例 1
以下示例包含字符串变量作为实参。在以下情况下，该条件的计算结果为 true：(1) $e.network.email.from 为 suspicious@gmail.com；(2) $e.network.email.from 为空且 $e.network.email.to 为 suspicious@gmail.com。
"suspicious@gmail.com" = strings.coalesce($e.network.email.from, $e.network.email.to)
示例 2
以下示例调用了具有两个以上实参的 coalesce 函数。此条件会将事件 $e 中的第一个非 null IP 地址与参考列表 ip_watchlist 中的值进行比较。此调用中实参的合并顺序与它们在规则条件中的枚举顺序相同：
- 系统会先评估
$e.principal.ip。
- 接下来，系统会评估
$e.src.ip。
- 接下来，系统会评估
$e.target.ip。
- 最后，如果之前的
ip 字段未设置，则返回字符串“No IP”作为默认值。
strings.coalesce($e.principal.ip, $e.src.ip, $e.target.ip, "No IP") in %ip_watchlist
示例 3
以下示例尝试合并事件 $e1 和事件 $e2 中的 principal.hostname。该示例会返回编译器错误，因为参数是不同的事件变量。
// returns a compiler error
"test" = strings.coalesce($e1.principal.hostname, $e2.principal.hostname)
如未另行说明，那么本页面中的内容已根据知识共享署名 4.0 许可获得了许可，并且代码示例已根据 Apache 2.0 许可获得了许可。有关详情，请参阅 Google 开发者网站政策。Java 是 Oracle 和/或其关联公司的注册商标。
最后更新时间 (UTC)：2025-07-29。
[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-07-29。"],[[["\u003cp\u003e\u003ccode\u003estrings.coalesce\u003c/code\u003e returns the first non-empty string from a list of arguments, or an empty string if all arguments are empty.\u003c/p\u003e\n"],["\u003cp\u003eThe function accepts an unlimited number of \u003ccode\u003eSTRING\u003c/code\u003e arguments, which can be literals, event fields, or function calls, as long as they are all of \u003ccode\u003eSTRING\u003c/code\u003e type.\u003c/p\u003e\n"],["\u003cp\u003eWhen using event fields as arguments, all attributes must originate from the same event.\u003c/p\u003e\n"],["\u003cp\u003eThe order of argument evaluation is sequential, as shown in the second example, with the first non-empty string being returned, and if none are met, the last option is returned.\u003c/p\u003e\n"],["\u003cp\u003eThe function is compatible with both Rules and Search functionalities.\u003c/p\u003e\n"]]],[],null,["### strings.coalesce\n\nSupported in: \n[Rules](/chronicle/docs/detection/default-rules) [Search](/chronicle/docs/investigation/udm-search) \n\n strings.coalesce(a, b, c, ...)\n\n#### Description\n\nThis function takes an unlimited number of arguments and returns the value of the first expression that does not evaluate to an empty string (for example, \"non-zero value\"). If all arguments evaluate to an empty string, the function call returns an empty string.\n\nThe arguments can be literals, event fields, or function calls. All arguments must be of `STRING` type. If any arguments are event fields, the attributes must be from the same event.\n\n#### Param data types\n\n`STRING`\n\n#### Return type\n\n`STRING`\n\n#### Code samples\n\n##### Example 1\n\nThe following example includes string variables as arguments. The condition\nevaluates to true when (1) `$e.network.email.from` is `suspicious@gmail.com` or\n(2) `$e.network.email.from` is empty and `$e.network.email.to` is\n`suspicious@gmail.com`. \n\n \"suspicious@gmail.com\" = strings.coalesce($e.network.email.from, $e.network.email.to)\n\n##### Example 2\n\nThe following example calls the `coalesce` function with more than two\narguments. This condition compares the first non-null IP address from event `$e`\nagainst values in the reference list `ip_watchlist`. The order that the\narguments are coalesced in this call is the same as the order they are\nenumerated in the rule condition:\n\n1. `$e.principal.ip` is evaluated first.\n2. `$e.src.ip` is evaluated next.\n3. `$e.target.ip` is evaluated next.\n4. Finally, the string \"No IP\" is returned as a default value if the previous `ip` fields are unset.\n\n strings.coalesce($e.principal.ip, $e.src.ip, $e.target.ip, \"No IP\") in %ip_watchlist\n\n##### Example 3\n\nThe following example attempts to coalesce `principal.hostname` from event\n`$e1` and event `$e2`. It will return a compiler error because the arguments are\ndifferent event variables. \n\n // returns a compiler error\n \"test\" = strings.coalesce($e1.principal.hostname, $e2.principal.hostname)"]]
