透過集合功能整理內容
你可以依據偏好儲存及分類內容。
strings.coalesce
strings.coalesce(a, b, c, ...)
說明
這個函式可接受無限數量的引數，並傳回第一個未評估為空字串的運算式值 (例如「非零值」)。如果所有引數評估結果都是空字串，函式呼叫會傳回空字串。
引數可以是常值、事件欄位或函式呼叫。所有引數都必須是 STRING 型別。如有任何引數是事件欄位，屬性必須來自同一個事件。
參數資料類型
STRING
傳回類型
STRING
程式碼範例
範例 1
以下範例包含做為引數的字串變數。當 (1) $e.network.email.from 為 suspicious@gmail.com 或 (2) $e.network.email.from 為空且 $e.network.email.to 為 suspicious@gmail.com 時，條件會評估為 true。
"suspicious@gmail.com" = strings.coalesce($e.network.email.from, $e.network.email.to)
範例 2
下列範例會使用兩個以上的引數呼叫 coalesce 函式。這項條件會比較事件 $e 中的第一個非空值 IP 位址與參照清單 ip_watchlist 中的值。這個呼叫中引數的合併順序，與規則條件中列舉的順序相同：
$e.principal.ip 會最先受到評估。$e.src.ip。$e.target.ip。- 如果先前的
ip 欄位未設定，則最後會傳回「No IP」字串做為預設值。
strings.coalesce($e.principal.ip, $e.src.ip, $e.target.ip, "No IP") in %ip_watchlist
範例 3
以下範例嘗試從事件 principal.hostname 和事件 $e2 合併 principal.hostname。$e1由於引數是不同的事件變數，因此會傳回編譯器錯誤。
// returns a compiler error
"test" = strings.coalesce($e1.principal.hostname, $e2.principal.hostname)
除非另有註明，否則本頁面中的內容是採用創用 CC 姓名標示 4.0 授權，程式碼範例則為阿帕契 2.0 授權。詳情請參閱《Google Developers 網站政策》。Java 是 Oracle 和/或其關聯企業的註冊商標。
上次更新時間：2025-07-29 (世界標準時間)。
[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-07-29 (世界標準時間)。"],[[["\u003cp\u003e\u003ccode\u003estrings.coalesce\u003c/code\u003e returns the first non-empty string from a list of arguments, or an empty string if all arguments are empty.\u003c/p\u003e\n"],["\u003cp\u003eThe function accepts an unlimited number of \u003ccode\u003eSTRING\u003c/code\u003e arguments, which can be literals, event fields, or function calls, as long as they are all of \u003ccode\u003eSTRING\u003c/code\u003e type.\u003c/p\u003e\n"],["\u003cp\u003eWhen using event fields as arguments, all attributes must originate from the same event.\u003c/p\u003e\n"],["\u003cp\u003eThe order of argument evaluation is sequential, as shown in the second example, with the first non-empty string being returned, and if none are met, the last option is returned.\u003c/p\u003e\n"],["\u003cp\u003eThe function is compatible with both Rules and Search functionalities.\u003c/p\u003e\n"]]],[],null,["### strings.coalesce\n\nSupported in: \n[Rules](/chronicle/docs/detection/default-rules) [Search](/chronicle/docs/investigation/udm-search) \n\n strings.coalesce(a, b, c, ...)\n\n#### Description\n\nThis function takes an unlimited number of arguments and returns the value of the first expression that does not evaluate to an empty string (for example, \"non-zero value\"). If all arguments evaluate to an empty string, the function call returns an empty string.\n\nThe arguments can be literals, event fields, or function calls. All arguments must be of `STRING` type. If any arguments are event fields, the attributes must be from the same event.\n\n#### Param data types\n\n`STRING`\n\n#### Return type\n\n`STRING`\n\n#### Code samples\n\n##### Example 1\n\nThe following example includes string variables as arguments. The condition\nevaluates to true when (1) `$e.network.email.from` is `suspicious@gmail.com` or\n(2) `$e.network.email.from` is empty and `$e.network.email.to` is\n`suspicious@gmail.com`. \n\n \"suspicious@gmail.com\" = strings.coalesce($e.network.email.from, $e.network.email.to)\n\n##### Example 2\n\nThe following example calls the `coalesce` function with more than two\narguments. This condition compares the first non-null IP address from event `$e`\nagainst values in the reference list `ip_watchlist`. The order that the\narguments are coalesced in this call is the same as the order they are\nenumerated in the rule condition:\n\n1. `$e.principal.ip` is evaluated first.\n2. `$e.src.ip` is evaluated next.\n3. `$e.target.ip` is evaluated next.\n4. Finally, the string \"No IP\" is returned as a default value if the previous `ip` fields are unset.\n\n strings.coalesce($e.principal.ip, $e.src.ip, $e.target.ip, \"No IP\") in %ip_watchlist\n\n##### Example 3\n\nThe following example attempts to coalesce `principal.hostname` from event\n`$e1` and event `$e2`. It will return a compiler error because the arguments are\ndifferent event variables. \n\n // returns a compiler error\n \"test\" = strings.coalesce($e1.principal.hostname, $e2.principal.hostname)"]]
