Conversion operators

FuseQL conversion operators transform values between different types and representations, including numeric formats and size/duration units.

dectohex

Converts a decimal (base-10) integer to its hexadecimal (base-16) string representation. Use dectohex to transform numeric fields — such as HTTP status codes or port numbers — into hex for display, correlation with hex-encoded identifiers, or protocol-level debugging.

Syntax

| dectohex(<longField>) as <alias>
none

Parameters

Parameter Required Description

<longField>

Required

A decimal integer field or literal to convert to hexadecimal.

<alias>

Required

Name for the resulting hexadecimal string field.

Example

Convert HTTP status codes parsed from nginx logs to their hexadecimal equivalents.

source="nginx"
| parse "* - - [*] \"* *\" * * *" as ip,date,method,url,status,bytes,rest
| dectohex(status) as status_hex
| first(status_hex) by status
Expected output
status first(status_hex)

200

c8

304

130

404

194

Values shown are illustrative; actual results depend on your log data. Use hextodec to reverse the conversion.

hextoascii

Converts a hexadecimal string to its ASCII text representation by interpreting each pair of hex characters as a byte. Use hextoascii to decode hex-encoded payloads, tokens, or message bodies that appear in log fields as raw hex strings.

Syntax

| hextoascii(<hexString>) as <alias>
none

Parameters

Parameter Required Description

<hexString>

Required

A hexadecimal string field or literal where each pair of characters represents one ASCII byte.

<alias>

Required

Name for the resulting ASCII string field.

Example

Decode a known hex-encoded string to verify the ASCII output.

source="nginx"
| parse "* - - [*] \"* *\" * * *" as ip,date,method,url,status,bytes,rest
| hextoascii("48656c6c6f") as decoded
| first(decoded) by method
Expected output
method first(decoded)

GET

Hello

POST

Hello

48656c6c6f is the hex encoding of Hello. The input must contain an even number of valid hex characters. Non-printable bytes in the output may appear as replacement characters depending on the rendering context.

hextodec

Converts a hexadecimal (base-16) string to its decimal (base-10) integer value. Use hextodec to decode hex-encoded identifiers, status codes, or addresses that appear in log fields before performing arithmetic or numeric comparisons.

Syntax

| hextodec(<hexString>) as <alias>
none

Parameters

Parameter Required Description

<hexString>

Required

A hexadecimal string field or literal to convert to a decimal integer.

<alias>

Required

Name for the resulting decimal integer field.

Example

Convert hex status code strings back to their decimal equivalents.

source="nginx"
| parse "* - - [*] \"* *\" * * *" as ip,date,method,url,status,bytes,rest
| dectohex(status) as status_hex
| hextodec(status_hex) as status_dec
| first(status_dec) by status
Expected output
status first(status_dec)

200

200

304

304

404

404

Values shown are illustrative; actual results depend on your log data. Use dectohex to convert in the opposite direction. The hex string must contain valid hexadecimal characters (0-9, a-f, A-F).

tobytes

Converts a human-readable storage size string (such as 1.5KB or 2MB) into the equivalent number of bytes as an integer. Use tobytes to normalize size fields that arrive in mixed units before aggregating or comparing them.

Syntax

| tobytes(<storageSize>) as <alias>
none

Parameters

Parameter Required Description

<storageSize>

Required

A string field or literal representing a size with a unit suffix. Supported units: B, KB, MB, GB, TB, and so on.

<alias>

Required

Name for the resulting integer field (bytes).

Example

Convert a static size string of 2MB to its byte equivalent.

source="nginx"
| parse "* - - [*] \"* *\" * * *" as ip,date,method,url,status,bytes,rest
| tobytes("2MB") as size_bytes
| first(size_bytes) by method
Expected output
method first(size_bytes)

GET

2097152

POST

2097152

2MB equals 2 × 1,048,576 = 2,097,152 bytes (using binary units: 1 KB = 1,024 bytes). Use tobytes with fields that hold size strings extracted from log messages before summing or averaging them.

toduration

Converts a string representation of a time duration to its value in milliseconds. Supported unit suffixes are ns (nanoseconds), µs or us (microseconds), ms (milliseconds), s (seconds), m (minutes), and h (hours). Use toduration to normalize latency or elapsed-time fields before aggregating them — for example, converting response durations extracted from application logs.

Syntax

| toduration(<timeString>) as <alias>
none

Parameters

Parameter Required Description

<timeString>

Required

A string field or literal representing a duration with a unit suffix. Supported units: ns, µs/us, ms, s, m, h.

<alias>

Required

Name for the resulting numeric field (milliseconds).

Example

Extract duration values from query-service logs and compute the average latency in milliseconds.

source="query-service"
| parse "* duration=*ms*" as pre,duration_ms,post
| toduration(duration_ms) as dur_num
| avg(dur_num) as avg_ms
Expected output
avg_ms

145.3

Values shown are illustrative; actual results depend on your log data. The unit suffix must be part of the string argument — for example, pass "188ms" not "188". A value in nanoseconds such as "500000ns" is converted to 0.5 ms.

tofloat

Parses a string representation of a number, or an integer, to a floating-point value. Use tofloat when a field is stored as a string but must be treated as a float for precise arithmetic or aggregation — for example, converting response times or byte counts before computing averages.

Syntax

| tofloat(<number>) as <alias>

| tofloat(<numberString>) as <alias>
none

Parameters

Parameter Required Description

<number> or <numberString>

Required

A numeric field, integer, or string representation of a number to convert to a floating-point value.

<alias>

Required

Name for the resulting float field.

Example

Convert the bytes field parsed from nginx logs to a float and compute the average response size per HTTP method.

source="nginx"
| parse "* - - [*] \"* *\" * * *" as ip,date,method,url,status,bytes,rest
| tofloat(bytes) as bytes_float
| avg(bytes_float) as avg_bytes by method
Expected output
method avg_bytes

GET

87284.0

POST

37.0

HEAD

0.0

Values shown are illustrative; actual results depend on your log data. Use tofloat when decimal precision matters — for example, when dividing counts to compute rates.

toint

Parses a string representation of a number, or a floating-point number, to an integer by truncating the decimal portion. Use toint when a field is stored as a string but must be treated as an integer for arithmetic, comparison, or aggregation — for example, converting the bytes field parsed from nginx logs before computing averages.

Syntax

| toint(<number>) as <alias>

| toint(<numberString>) as <alias>
none

Parameters

Parameter Required Description

<number> or <numberString>

Required

A numeric field, floating-point value, or string representation of a number to convert. Decimal portions are truncated.

<alias>

Required

Name for the resulting integer field.

Example

Convert the bytes field parsed from nginx logs to an integer and compute the average response size per HTTP method.

source="nginx"
| parse "* - - [*] \"* *\" * * *" as ip,date,method,url,status,bytes,rest
| toint(bytes) as bytes_int
| avg(bytes_int) as avg_bytes by method
Expected output
method avg_bytes

GET

87,284

POST

37

HEAD

0

Values shown are illustrative; actual results depend on your log data. Decimal values are truncated, not rounded — toint("1.9") returns 1.