Concatenates the values of all fields with the same name and an array
suffix into a value in a new field. Such array fields typically come as
output from either parseJson() or
splitString().
All array fields starting with index from and ending with index to are selected. If some index is missing, the concatenation stops with the previous index, thus if only index 0, 1 and 3 are present, only index 0 and 1 are concatenated. If the first index is missing, no field is added to the event.
| Parameter | Type | Required | Default | Description |
|---|---|---|---|---|
as | string | optional[a] | _concatArray | Name of output field. |
field[b] | string | required | Base name for array fields to concatenate. | |
from | number | optional[a] | 0 | First array index to include [0..∞]. |
prefix | string | optional[a] | Prefix to prepend to the generated string. | |
separator | string | optional[a] | Separator between values. | |
suffix | string | optional[a] | Suffix to append to the generated string. | |
to | number | optional[a] | Last array index to include (leave out to get all). Must be equal to or larger than from. | |
[a] Optional parameters use their default value unless explicitly set. | ||||
Hide omitted argument names for this function
Omitted Argument NamesThe argument name for
fieldcan be omitted; the following forms of this function are equivalent:logscaleconcatArray("field")and:
logscaleconcatArray(field="field")These examples show basic structure only.
concatArray() Examples
Concatenate the values of fields server[0], server[1] and so on and put it into a new field named _concatArray.
concatArray(server)Put the result into a field named servers.
concatArray(server, as=servers)Select only fields with indexes 1 to 3.
concatArray(server, from=1, to=3)Add a separator between concatenated values.
concatArray(server, separator=", ")Add a prefix and suffix to the generated string.
concatArray(server, prefix="[", suffix="]")