The concat() is not able to concatenate
fields and strings together. For example to create a pathname
based on the directory and filename it is not possible to do:
logscale
concat([dirname,"/",filename],as=pathname)
This will raise an error. Instead, we can use
format().
In this example, the objectArray:eval()
function is used with the concat() function
to concatenate multiple deeply nested arrays of objects values
in the array foo[] and
return the concatenated values in the output field
_mapped[]
Example incoming data might look like this:
JSON
"foo[0].key.value": y
"foo[0].key.others[0]":1"foo[0].key.others[1]":2"foo[1].nothing":355
Notice that a
var
parameter can be used to give a different name to the input
array variable inside the function argument. This is
particularly useful whenever the input array name is very
long.
Event Result set.
Summary and Results
The query is used to concatenate multiple deeply nested arrays
of objects values.
Sample output from the incoming example data:
_mapped[0]: y12
"foo[0].key.value": y
"foo[0].key.others[0]": 1
"foo[0].key.others[1]": 2
In this example, the objectArray:eval()
function is used with the concat() function
to concatenate deeply nested arrays of objects values in the
array in[] and return the
concatenated values in the output field
out[].
Iterates over the array from start to end (or to the first empty
index in the array), applies the given function, and returns the
concatenated results in a new output array name field
out[].
Event Result set.
Summary and Results
The query is used to concatenate deeply nested arrays of
objects.
Sample output from the incoming example data:
out[0]: 124
Concatenate Values From Two Nested Array Elements
Concatenate values from two nested array elements returning output in flat array
In this example, the
objectArray:eval() function is used with the
variable x to concatenate
the values a and b from each array
element. The concat() function is used to
return the concatenated output into a new array.
Concatenates the values a and b from
each array element and returns the results in a new array
named _mapped. In this example,
objectArray:eval() iterates over each
element of the array and assigns each element to the variable
x which is then used as an alias. The new field
_mapped is created by concatenating the
value using the alias x to extract each object
value from each element of the array. Notice that the output
in this example is a flat array.
For example, this array element:
arr[0].a: a0
arr[0].b: b0
is translated to:
_mapped[0]: a0b0
Event Result set.
Summary and Results
The query is used to concatenate values of two array elements.
Sample output from the incoming example data, the original
values have not been removed:
Concatenate values in two fields into a single value in a new array using the concat() function
Query
logscale
concat([aidValue,cidValue],as=checkMe2)
Introduction
In this example, the concat() function
concatenates the AID (Agent ID) and CID (Customer ID) values
into a single value in a new array.
Step-by-Step
Starting with the source repository events.
logscale
concat([aidValue,cidValue],as=checkMe2)
Concatenates the values of the fields
aidValue and cidValue
into a single value in a new field named
checkMe2.
The single value contains both the Agent ID and Customer ID
information. It is recommended to have a consistent format and
potentially include a separator between the AID and CID to
ensure, that they can be easily parsed apart, if needed later.
Event Result set.
Summary and Results
The query is used to concatenate the values of a list of fields
into a single value in a new field. Combining CID and AID values
is, for example, useful for unique identification,
troubleshooting, data analysis etc. This query is also useful in
case you want to combine for example first names and last names
from two different fields into the full name in a new field, or
if you have a list of users and a list of the URLs visited, that
you want to combine to see which user navigated which URLs.
Concatenate Values in Two Fields - Example 2
Concatenate values in two fields into a single value in a new array using the concat() function
Query
logscale
concat([f1,f2],as="combined")
Introduction
In this example, the concat() function
concatenates the values of two fields with different names
(f1 and f2) into a
single value in a new field.
Step-by-Step
Starting with the source repository events.
logscale
concat([f1,f2],as="combined")
Concatenates the values of the arrays f1
and f2 into a single value in a new array
named combined.
Event Result set.
Summary and Results
The query is used to concatenate the values of a list of fields
into a single value in a new field. This query is useful in case
you want to combine for example first names and last names from
two different fields into the full name in a new field, or if
you have a list of users and a list of the URLs visited, that
you want to combine to see which user navigated which URLs.