Filters events from the input array using the function provided in the array.

The order is maintained in the output array.

ParameterTypeRequiredDefaultDescription
array[a]stringrequired  The array name in LogScale Array Syntax, for example for events with fields incidents[0], incidents[1], ... this would be incidents[], as in array:filter(array="incidents[]", ...).
asArraystringoptional[b]  The output array. Defaults to the value passed to the array parameter.
functionNon-aggregate functionrequired  The function to use for filtering events in the array.
varstringrequired  Name of the variable to be used in function argument.

[a] The argument name array can be omitted.

[b] Optional parameters use their default value unless explicitly set.

Hide omitted argument names for this function

Show omitted argument names for this function

Given an array of three elements:

mailto[0]=foo@example.com
mailto[1]=bar@example.com
mailto[2]=baz@example.com

Retrieve those where the address starts with ba using the following query:

logscale
array:filter(array="mailto[]", var="addr", function={addr=ba*@example.com}, asArray="out[]")

Expected output:

logscale
out[0]=bar@example.com
out[1]=baz@example.com