Use this page to look up expression syntax in Sift. Expressions are written using Common Expression Language (CEL) and are used in Calculated Channels, Rules, and User-Defined Functions.
Channel references
When configuring a Rule, Calculated Channel, or User-Defined Function, you select input Channels by name from the Input Channels selector. Sift automatically assigns each selected Channel a shorthand variable based on selection order: $1 for the first Channel, $2 for the second, $3 for the third, and so on. Use these variables to reference the corresponding Channel in your expression.
Operators
The following table lists the CEL operators supported in Sift. Not all CEL operators are supported.
Functions
The Expression Syntax panel in the expression editor organizes functions into the following sections:
Stateful functions
Stateful functions compute values using data from preceding rows within a rolling time window of up to 10 minutes. Use them to track trends, detect gradual changes, and compute time-based metrics across telemetry data.
The following table lists all available stateful functions with expanded descriptions to help you choose the right function for your use case.
File functions
File functions allow Rules and Calculated Channel expressions to access data from files attached to an Asset or a Run. Once a file is loaded, you access specific values using bracket notation. The syntax depends on the file format.
Live Rules: File functions are not supported in live Rule evaluation.
File size: The maximum file size per file is 10 MB.
Bracket notation
Once a file is loaded, use bracket notation to access specific values. The syntax depends on the file format.
JSON and YAML
JSON and YAML files resolve to a map. Use bracket notation to index into keys. For nested objects, chain brackets. To access an item in a list, use a numeric index.
CSV
CSV files resolve to a column-oriented structure. Use the column name or column index (0-based) as the first bracket and a row number as the second.
TXT
TXT files resolve to a string literal. To use the value numerically, cast it with a function like double().
User-Defined Functions
The User-Defined Functions section of the expression editor lists all named, reusable functions created across your organization. Call any function by name directly in your expression. To learn more, see User-Defined Functions settings.
Behavior
The following table describes known constraints and behaviors to be aware of when writing expressions in Sift.
