Eval Node
The Eval node is a powerful transformation component in ZephFlow that applies expressions to modify, filter, or enrich incoming events. It uses the Fleak Eval Expression Language (FEEL) to transform data as it flows through your pipeline.
For more details of using FEEL, please refer to FEEL Reference
Eval node requires the transformation result to be a dict/map/object. Array or primitive values such as strings, numbers and booleans will cause the evaluate to fail.
Key Features
- Transform data structures with concise expressions
- Create new fields or modify existing ones
- Apply conditional logic to event processing
- Extract values from complex nested structures
- Convert between data types
- Manipulate strings, arrays, and dictionaries
Attaching Eval Node Using SDK
ZephFlow flow = ZephFlow.startFlow();
flow.eval("your FEEL");
Basic Usage
Transform Example
dict(
user_id=$.user.id,
total_amount=$.items[0].price * $.items[0].quantity,
timestamp=ts_str_to_epoch($.created_at, "yyyy-MM-dd'T'HH:mm:ss")
)
This transforms each event by creating a new structure with the user's ID, calculated total amount, and a properly formatted timestamp.
Field Enrichment Example
dict_merge(
$,
dict(
full_name=$.first_name + " " + $.last_name,
is_valid=$.age >= 18 and $.country == "US"
)
)
This preserves the original event and adds two new fields: full_name and is_valid.
Examples
Data Normalization
dict(
event_type="user_login",
user=dict(
id=$.userId,
email=lower($.email),
role=case(
$.permissions == "admin" => "ADMIN",
$.permissions == "editor" => "EDITOR",
_ => "USER"
)
),
metadata=dict(
source=$.src,
timestamp=ts_str_to_epoch($.event_time, "yyyy-MM-dd HH:mm:ss.SSS")
)
)
Event Filtering with Conditional Output
case(
$.status_code >= 400 => dict_merge(
$,
dict(
error_type=case(
$.status_code >= 500 => "SERVER_ERROR",
_ => "CLIENT_ERROR"
),
severity=case(
$.status_code >= 500 => "HIGH",
_ => "MEDIUM"
)
)
),
_ => null
)
This transforms error events by adding error classification fields, and returns null for non-error events (which can
be filtered out by a null filter node).
Processing Array Data
arr_foreach(
$.logs,
log,
dict(
timestamp=ts_str_to_epoch(log.time, "yyyy-MM-dd'T'HH:mm:ss.SSSZ"),
level=upper(log.level),
service=$.service_name,
message=log.msg,
has_error=str_contains(log.msg, "error")
)
)
This transforms an array of log entries into a structured format with additional derived fields.