Filters events from the input array using the function provided in the array.

The order is maintained in the output array.

ParameterTypeRequiredDefaultDescription
array[a]stringrequired  A string in the format of a valid array followed by []. A valid array can either be an identifier, a valid array followed by . and an identifier, or a valid array followed by an array index surrounded by square brackets. For example, for events with fields incidents[0], incidents[1], ... this would be incidents[] .
functionNon-aggregate functionrequired  The function to use for filtering events in the array.
varstringrequired  Name of the variable to be used in function argument.

[a] The argument name array can be omitted.

Hide omitted argument names for this function

Show omitted argument names for this function

Given an array of three elements, retrieve those where the address starts with ba:

logscale
mailto[0]=foo@example.com
mailto[1]=bar@example.com
mailto[2]=baz@example.com

Query function:

logscale
array:filter(array="mailto[]", var="addr", function={addr=ba*@example.com}, asArray="out[]")

Expected output:

logscale
out[0]=bar@example.com
out[1]=baz@example.com