Important

This function must be enabled using the feature flag ArrayFunctions. See Enabling & Disabling Feature Flags.

Did you find this function useful? We are soliciting feedback on this function. Please use this form to provide input about how you've used the function and whether it met your needs.

Determines the set intersection of array values over input events. Use this to compute the values that occur in all events supplied to this function.

  • The output order of the values is not defined.

  • Empty arrays are ignored.

  • If no arrays are found, the output is empty.

ParameterTypeRequiredDefault ValueDescription
array[a]stringrequired  The prefix of the array in LogScale, for example, for events with fields incidents[0], incidents[1], ... this would be incidents.
asstringoptional[b]_intersection The name of the output array.

[a] The argument name array can be omitted.

[b] Optional parameters use their default value unless explicitly set.

Hide omitted argument names for this function

Show omitted argument names for this function

Find Set Intersection Within an Array

Find set intersection within a single flat array using the array:intersection() function

Query
logscale
array:intersection("mailto[]", as=unique_mails)
Introduction

Set intersection refers to finding the common elements within array. The result of the intersection operation is a new dataset containing only the elements that are common to all the input sets (similar to a join operation). In this example, the array:intersection() function will return the unique email addresses from an array. The intersection of the array is based on the intersection of unique values within each element.

Example incoming data might look like this:

logscale
mailto[0]=foo@example.com
mailto[1]=bar@example.com
mailto[2]=bar@example.com
Step-by-Step

  1. Starting with the source repository events.

  2. logscale
    array:intersection("mailto[]", as=unique_mails)

    Returns the intersection of element values in the array mailto[], in this case email adresses, storing the result in a new intersection set array unique_mails and stores them as unique values.

  3. Event Result set.

Summary and Results

The result of the intersection operation is a new dataset that consists of all the common elements occurring in an array. The query is used to simplify data in an array for any common values and make a new array with only the unique values in it. This can be useful when processing a set of values and looking for the unique list, for example to use as labels within a graph, or as input parameters to a filter.

Sample output from the incoming example data:

logscale
unique_mails[0]=foo@example.com
unique_mails[1]=bar@example.com