case
case
⚡ ConditionalReturn a value based on the first matching condition, or a default if none match
case(cond1, val1, cond2, val2, ..., default) → any any Returns the value paired with the first true condition, or default if none match; null if matching condition is null
The case function evaluates a series of conditions and returns the value associated with the first condition that is true. If none match, it returns the default value.
Edge Cases
Section titled “Edge Cases”- If a
conditionisnull, it is treated asfalse(evaluation continues) - Evaluation stops at the first
truecondition (short-circuit behavior) - The
default_value(last argument) is required - Value types can vary across branches; return type depends on matched value
- Odd number of arguments required: pairs of (condition, value) plus the default
Examples
Section titled “Examples”Simple Status Mapping
Section titled “Simple Status Mapping”| eval status_label = case(status == "error", "Error", status == "warn", "Warning", "OK")
Maps status codes to readable labels: “Error”, “Warning”, or “OK”.
Log Level Categorization
Section titled “Log Level Categorization”| eval severity_tier = case(level == "FATAL", 1, level == "ERROR", 2, level == "WARN", 3, level == "INFO", 4, 5)
Assigns severity tier numbers: FATAL=1, ERROR=2, WARN=3, INFO=4, other=5.
Response Time Classification
Section titled “Response Time Classification”| eval performance = case(response_time_ms < 100, "fast", response_time_ms < 500, "normal", response_time_ms < 1000, "slow", "very slow")
Categorizes requests by response time.
Multi-criteria Segmentation
Section titled “Multi-criteria Segmentation”| eval customer_segment = case(total_spent > 10000, "premium", total_spent > 1000, "standard", login_count == 0, "inactive", "active")
Customer segmentation based on spend and activity.
Environment-Based Alerting
Section titled “Environment-Based Alerting”| eval should_alert = case(environment == "production" && error_count > 10, true, environment == "staging" && error_count > 50, true, false)
Alert conditions vary by environment.
For simpler two-branch conditions, see If.
Used In
Section titled “Used In”eval— to create fields with multi-branch conditional values