Important
This function must be enabled using the feature flag ArrayFunctions. See Enabling & Disabling Feature Flags.
Did you find this function useful? We are soliciting feedback on this function. Please use this form to provide input about how you've used the function and whether it met your needs.
Determines the set intersection of array values over input events. Use this to compute the values that occur in all events supplied to this function.
The output order of the values is not defined.
Empty arrays are ignored.
If no arrays are found, the output is empty.
Parameter | Type | Required | Default | Description |
---|---|---|---|---|
array [a] | string | required | The prefix of the array in LogScale, for example for events with fields incidents[0], incidents[1], ... this would be incidents . | |
as | string | optional[b] | _intersection | The name of the output array |
[b] Optional parameters use their default value unless explicitly set. |
Hide omitted argument names for this function
Omitted Argument NamesThe argument name for
array
can be omitted; the following forms of this function are equivalent:logscalearray:intersection("value[]")
and:
logscalearray:intersection(array="value[]")
These examples show basic structure only.
array:intersection()
Examples
Given two events with the fields:
mailto[0]=foo@example.com
mailto[1]=bar@example.com
mailto[0]=bar@example.com
Return the addresses present in all events:
array:intersection(mailto, as=unique_mails)
Expected result:
unique_mails[0]=bar@example.com