The concat() is not able to concatenate fields and
strings together. For example to create a pathname based on the
directory and filename it is not possible to do:
logscale
concat([dirname,"/",filename],as=pathname)
This will raise an error. Instead, we can use
format().
In this example, the objectArray:eval() function is
used with the concat() function to concatenate
multiple deeply nested arrays of objects values in the array
foo[] and return the concatenated
values in the output field
_mapped[]
Example incoming data might look like this:
JSON
"foo[0].key.value": y
"foo[0].key.others[0]":1"foo[0].key.others[1]":2"foo[1].nothing":355
Notice that a
var parameter
can be used to give a different name to the input array variable
inside the function argument. This is particularly useful whenever the
input array name is very long.
Event Result set.
Summary and Results
The query is used to concatenate multiple deeply nested arrays of
objects values.
Sample output from the incoming example data:
_mapped[0]: y12
"foo[0].key.value": y
"foo[0].key.others[0]": 1
"foo[0].key.others[1]": 2
In this example, the objectArray:eval() function is
used with the concat() function to concatenate
deeply nested arrays of objects values in the array
in[] and return the concatenated
values in the output field
out[].
Iterates over the array from start to end (or to the first empty index
in the array), applies the given function, and returns the concatenated
results in a new output array name field
out[].
Event Result set.
Summary and Results
The query is used to concatenate deeply nested arrays of objects.
Sample output from the incoming example data:
out[0]: 124
Concatenate Values From Two Nested Array Elements
Concatenate values from two nested array elements returning output in flat array
In this example, the objectArray:eval() function is
used with the variable x to
concatenate the values a and
b from each array element. The
concat() function is used to return the
concatenated output into a new array.
Concatenates the values a and
b from each array element and returns
the results in a new array named
_mapped. In this example,
objectArray:eval() iterates over each element of
the array and assigns each element to the variable
x which is then used as an alias. The
new field _mapped is created
by concatenating the value using the alias
x to extract each object value from
each element of the array. Notice that the output in this example is a
flat array.
For example, this array element:
arr[0].a: a0
arr[0].b: b0
is translated to:
_mapped[0]: a0b0
Event Result set.
Summary and Results
The query is used to concatenate values of two array elements.
Sample output from the incoming example data, the original values have
not been removed:
Concatenate values in two fields into a single value in a new array using the concat() function
Query
logscale
concat([aidValue,cidValue],as=checkMe2)
Introduction
In this example, the concat() function concatenates
the AID (Agent ID) and CID (Customer ID) values into a single value in a
new array.
Step-by-Step
Starting with the source repository events.
logscale
concat([aidValue,cidValue],as=checkMe2)
Concatenates the values of the fields
aidValue and
cidValue into a single value in
a new field named checkMe2.
The single value contains both the Agent ID and Customer ID
information. It is recommended to have a consistent format and
potentially include a separator between the AID and CID to ensure,
that they can be easily parsed apart, if needed later.
Event Result set.
Summary and Results
The query is used to concatenate the values of a list of fields into a
single value in a new field. Combining CID and AID values is, for
example, useful for unique identification, troubleshooting, data
analysis etc. This query is also useful in case you want to combine for
example first names and last names from two different fields into the
full name in a new field, or if you have a list of users and a list of
the URLs visited, that you want to combine to see which user navigated
which URLs.
Concatenate Values in Two Fields - Example 2
Concatenate values in two fields into a single value in a new array using the concat() function
Query
logscale
concat([f1,f2],as="combined")
Introduction
In this example, the concat() function concatenates
the values of two fields with different names
(f1 and
f2) into a single value in a new
field.
Step-by-Step
Starting with the source repository events.
logscale
concat([f1,f2],as="combined")
Concatenates the values of the arrays
f1 and
f2 into a single value in a new
array named combined.
Event Result set.
Summary and Results
The query is used to concatenate the values of a list of fields into a
single value in a new field. This query is useful in case you want to
combine for example first names and last names from two different fields
into the full name in a new field, or if you have a list of users and a
list of the URLs visited, that you want to combine to see which user
navigated which URLs.
