Documentation Index
Fetch the complete documentation index at: https://docs.siftstack.com/llms.txt
Use this file to discover all available pages before exploring further.
Use this page to look up expression syntax in Sift. Expressions are written using Common Expression Language (CEL) and are used in Calculated Channels, Rules, and User-Defined Functions.
Channel references
When configuring a Rule, Calculated Channel, or User-Defined Function, you select input Channels by name from the Input Channels selector. Sift automatically assigns each selected Channel a shorthand variable based on selection order: $1 for the first Channel, $2 for the second, $3 for the third, and so on. Use these variables to reference the corresponding Channel in your expression.
Operators
The following table lists the CEL operators supported in Sift. Not all CEL operators are supported.
Functions
The Expression Syntax panel in the expression editor organizes functions into the following sections:
Log channel functions
Sift provides a built-in function for working with log-type Channels.
Stateful functions
Stateful functions compute values using data from preceding rows within a rolling time window of up to 10 minutes. Use them to track trends, detect gradual changes, and compute time-based metrics across telemetry data.
The following table lists all available stateful functions with expanded descriptions to help you choose the right function for your use case.
User-Defined Functions
The User-Defined Functions section of the expression editor lists all named, reusable functions created across your organization. Call any function by name directly in your expression. To learn more, see User-Defined Functions settings.
Behavior
The following table describes known constraints and behaviors to be aware of when writing expressions in Sift.
