FPL

The Fluency Programming Language (FPL) is the language that expresses everything the platform does to data — parsing, transformation, enrichment, detection, notification and reporting. Wherever a product surface holds code rather than a search box, that code is FPL: processors, receivers, packers, actions and rules are all FPL objects, managed from Platform → Processors.

FPL is a real programming language, not a query syntax. The industry standard in a SIEM is SQL, designed for relational databases, with a per-vendor query language layered on top — SPL for Splunk, CloudWatch Query Language for AWS, Kusto for Azure. None of those supports if/else, loops, or genuine function calls. FPL does, along with a large library of utility functions for data analysis and visualization. That is what allows data to be moved, transformed, processed and stored programmatically rather than merely searched, and it is why the language's stated goal is solving API integration.

Programming, not Processing

Both expansions appear in official material. This manual follows the product interface and reads FPL as Fluency Programming Language; the Processing variant is used in some Ingext documentation. See the Glossary naming notes.

In this section

The language

• Operators — arithmetic, comparison, logical and assignment operators, and their precedence.
• Data Types — the primitive and composite types, and the function library for each.
• Control Blocks — if/else, loops, and the block structures that make FPL programmable.
• Functions — declaring and calling functions.
• Conditions — the condition forms used in rules and filters.

Data type functions

• String Functions
• Array, Map and JSON Functions
• Table Functions
• Blob Functions
• Time
• Lambda

Utility functions

• Utility Functions — the library overview.
• Environment Functions
• Global Functions
• Parse Functions
• Print Functions

Pattern matching

• Writing RegEx Pattern Parsers — building a parser around a regular expression.
• Getting Regex from ChatGPT

Related

• Processors — where parsing and transformation FPL runs.
• Parser cookbooks — complete, working FPL parsers for real devices.
• Report cookbooks — FPL that produces reports.
• Glossary — the vocabulary the language reference assumes.
• FPL Manual — the language's own site, maintained separately from this manual.