Updated at: 2022-12-09 03:49:50
It is a rule before each layer of parsing to provide a restriction for that layer of parsing, and is to resolve scenarios where some fields may not be available in similar logs and global parsing in such scenarios may result in inaccurate parsing.
After the precondition is enabled, the parsing of the layer of log is allowed only if the precondition is Yes. The configuration parameters are as follows: 
Note: Before precondition verification, make sure the condition object field in precondition has been parsed and extracted.
The precondition consists of 2 parts: condition object and operator: 
• Condition Object Type:
Condition Object Type Description
Field Name If the condition object is a field name, [field] in brackets is used to indicate field name.
Number If the condition object is a number, just use the number directly.
String If the condition object is a string, use single or double quotation marks to indicate the string object.
Example: [a] == "a" or [a] == 1 means that the field a is equal to the string a or the number 1.
• Operator: Represent the relationship between condition objects. There are the following operators:
Operator Type Description
Comparison Operator ==, !=, <, >, <=, >=
Example: [a] != 1; "hello" == "world"; 5>2
Regular Match Operator =~, !~
Example: [a]=~"^#" means that the matched field a starting with # is Yes; !~ means to reverse the matched result.
Member Operator in, not in
Example: [a] not in ["hello world"], means the condition is Yes when the field a is not in the hello world; "a" in "abc", means the condition is Yes when the string a is in abc.
Logical Operator and, or, nand, xor 
Example: [a] and [b] means that the condition is Yes when both field a and field b exist.
Unary Operator ！
Example: ! [a] means that the condition is Yes if the field a does not exist or is null.