使用集合让一切井井有条
根据您的偏好保存内容并对其进行分类。
strings.concat
strings.concat(a, b, c, ...)
说明
返回任意数量的项的串联，每项可以是字符串、整数或浮点数。
如果任何实参是事件字段，则这些属性必须来自同一事件。
形参数据类型
STRING、FLOAT、INT
返回类型
STRING
代码示例
示例 1
以下示例包含字符串变量和整数变量作为实参。principal.hostname 和 principal.port 都来自同一事件 $e，并串联在一起以返回字符串。
"google:80" = strings.concat($e.principal.hostname, ":", $e.principal.port)
示例 2
以下示例包含字符串变量和字符串字面量作为实参。
"google-test" = strings.concat($e.principal.hostname, "-test") // Matches the event when $e.principal.hostname = "google"
示例 3
以下示例包含字符串变量和浮点字面量作为参数。以字符串表示时，整数形式的浮点数不包含小数点（例如，1.0 表示为“1”）。此外，超过 16 位小数的浮点数会被截断到第 16 位小数。
"google2.5" = strings.concat($e.principal.hostname, 2.5)
示例 4
以下示例包含字符串变量、字符串字面量、整数变量和浮点字面量作为实参。所有变量都来自同一事件 $e，并与字面量串联在一起以返回字符串。
"google-test802.5" = strings.concat($e.principal.hostname, "-test", $e.principal.port, 2.5)
示例 5
以下示例尝试将来自事件 $e1 的 principal.port 与来自事件 $e2 的 principal.hostname 串联。该示例会返回编译器错误，因为参数是不同的事件变量。
// Will not compile
"test" = strings.concat($e1.principal.port, $e2.principal.hostname)
如未另行说明，那么本页面中的内容已根据知识共享署名 4.0 许可获得了许可，并且代码示例已根据 Apache 2.0 许可获得了许可。有关详情，请参阅 Google 开发者网站政策。Java 是 Oracle 和/或其关联公司的注册商标。
最后更新时间 (UTC)：2025-07-29。
[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-07-29。"],[[["\u003cp\u003e\u003ccode\u003estrings.concat\u003c/code\u003e combines multiple strings, integers, or floats into a single string, supporting an unlimited number of arguments.\u003c/p\u003e\n"],["\u003cp\u003eWhen using event fields as arguments within \u003ccode\u003estrings.concat\u003c/code\u003e, all fields must be attributes originating from the same event.\u003c/p\u003e\n"],["\u003cp\u003eThe function supports various data types, including \u003ccode\u003eSTRING\u003c/code\u003e, \u003ccode\u003eFLOAT\u003c/code\u003e, and \u003ccode\u003eINT\u003c/code\u003e, and returns a \u003ccode\u003eSTRING\u003c/code\u003e value after concatenation.\u003c/p\u003e\n"],["\u003cp\u003eFloat numbers in \u003ccode\u003estrings.concat\u003c/code\u003e are formatted as whole numbers without a decimal point when they are whole numbers, and they are truncated to the sixteenth decimal place if exceeding that value.\u003c/p\u003e\n"],["\u003cp\u003eAttempting to concatenate event fields that belong to different events will result in a compiler error.\u003c/p\u003e\n"]]],[],null,["### strings.concat\n\nSupported in: \n[Rules](/chronicle/docs/detection/default-rules) [Search](/chronicle/docs/investigation/udm-search) \n\n strings.concat(a, b, c, ...)\n\n#### Description\n\nReturns the concatenation of an unlimited number of items, each of which can be\na string, integer, or float.\n\nIf any arguments are event fields, the attributes must be from the same event.\n\n#### Param data types\n\n`STRING`, `FLOAT`, `INT`\n\n#### Return type\n\n`STRING`\n\n#### Code samples\n\n##### Example 1\n\nThe following example includes a string variable and integer variable as\narguments. Both `principal.hostname` and `principal.port` are from the same\nevent, `$e`, and are concatenated to return a string. \n\n \"google:80\" = strings.concat($e.principal.hostname, \":\", $e.principal.port)\n\n##### Example 2\n\nThe following example includes a string variable and string literal as arguments. \n\n \"google-test\" = strings.concat($e.principal.hostname, \"-test\") // Matches the event when $e.principal.hostname = \"google\"\n\n##### Example 3\n\nThe following example includes a string variable and float literal as arguments.\nWhen represented as strings, floats that are whole numbers are formatted without\nthe decimal point (for example, 1.0 is represented as \"1\"). Additionally,\nfloats that exceed sixteen decimal digits are truncated to the sixteenth decimal\nplace. \n\n \"google2.5\" = strings.concat($e.principal.hostname, 2.5)\n\n##### Example 4\n\nThe following example includes a string variable, string literal,\ninteger variable, and float literal as arguments. All variables are from the\nsame event, `$e`, and are concatenated with the literals to return a string. \n\n \"google-test802.5\" = strings.concat($e.principal.hostname, \"-test\", $e.principal.port, 2.5)\n\n##### Example 5\n\nThe following example attempts to concatenate principal.port from event `$e1`,\nwith `principal.hostname` from event `$e2`. It will return a compiler error\nbecause the arguments are different event variables. \n\n // Will not compile\n \"test\" = strings.concat($e1.principal.port, $e2.principal.hostname)"]]
