EDXDecompress

Learn about the EDXDecompress Edge Delta OTTL extension function.

  less than a minute  

Minimum Agent Version: v1.31.0

EDXDecompress complements EDXCompress and fills a gap in standard OTTL which lacks native decompression capabilities. This Edge Delta extension enables you to decompress byte arrays that have been compressed with various algorithms, allowing you to work with compressed data sources in your telemetry pipeline.

Syntax

EDXDecompress(data, algorithm)
  • data: The compressed byte array or string to decompress (can be a field reference or literal).
  • algorithm: The decompression algorithm to use. Supported values: "gzip", "zlib", "deflate", "snappy", "zstd", "lz4".

Input

{
  "_type": "log",
  "timestamp": 1735789300000,
  "body": "[compressed byte array]",
  "resource": {...},
  "attributes": {
    "compression": "gzip",
    "compressed_size": 52
  },
  "cache": {
    "body": "[compressed byte array]"
  }
}

Example

set(attributes["decompressed_body"], EDXDecompress(cache["body"], "gzip"))
set(attributes["decompressed_size"], Len(attributes["decompressed_body"]))

Output

{
  "_type": "log",
  "timestamp": 1735789330000,
  "body": "[compressed byte array]",
  "resource": {...},
  "attributes": {
    "compression": "gzip",
    "compressed_size": 52,
    "decompressed_body": "This is a very long log message that contains repeated information. This is a very long log message that contains repeated information. This is a very long log message that contains repeated information.",
    "decompressed_size": 198
  },
  "cache": {
    "body": "[compressed byte array]"
  }
}

The compressed data from cache["body"] has been decompressed and stored as a string in attributes["decompressed_body"], restoring the original 198-byte message from the 52-byte compressed format.