Filters events from the input array using the function provided in the array.

The order is maintained in the output array.

ParameterTypeRequiredDefaultDescription
array[a]stringrequired  A string in the format of a valid array followed by []. A valid array can either be an identifier, a valid array followed by . and an identifier, or a valid array followed by an array index surrounded by square brackets. For example, for events with fields incidents[0], incidents[1], ... this would be incidents[] .
functionNon-aggregate functionrequired  The function to use for filtering events in the array.
varstringrequired  Name of the variable to be used in function argument.

[a] The argument name array can be omitted.

Omitted Argument Names

The argument name for array can be omitted; the following forms of this function are equivalent:

logscale
array:filter("value[]",var="value",function="value")

and:

logscale
array:filter(array="value[]",var="value",function="value")

These examples show basic structure only; full examples are provided below.

Given an array of three elements, retrieve those where the address starts with ba:

logscale
mailto[0]=foo@example.com
mailto[1]=bar@example.com
mailto[2]=baz@example.com

Query function:

logscale
array:filter(array="mailto[]", var="addr", function={addr=ba*@example.com}, asArray="out[]")

Expected output:

logscale
out[0]=bar@example.com
out[1]=baz@example.com