The array:exists() function is available
from version 1.175.0.
The function filters events based on array contents. It checks
if an array contains at least one element that meets a specified
condition.
The array:exists() function is useful when
array:contains() is not flexible enough,
for example, when users want to compare the elements of the
array to the values of other fields or when they want to use
query functions in the condition.
Name of the array in which to search for matching elements. Must follow valid Array Syntax for array of scalars. For example, for events with fields incidents[0], incidents[1], ... this would be incidents[].
In this example, the array:exists() function is
used with the condition
argument and the filter function in() to check if
given values are in the array.
In this example, the array:exists() function is
used with the condition
argument and if() function along with the
in() function to check if given values are in the
array.
The example demonstrates how to use the () function
along with the () function to create a logical
OR-like condition in the expression language. It allows for more complex
filtering logic, when a direct logical OR operator is
not available.
Filters for events where the
a[] array contains the values
2 or 5. If not containing these
values, it filters for events where the
a[] array contains the values
3 or 6.
Event Result set.
Summary and Results
The query is used to check for the existence of simple values in nested
arrays.
Sample output from the incoming example data:
a[0]
a[1]
1
2
1
3
Check For Existence of Elements Using Filtering Pipeline
Check for the existence of element in a flat array using the
array:exists() function with a filtering
pipeline
Filters for events where the
a[] array contains the values
3 or 4 and where
x is greater than or equal to the value of the
field b in the event.
Event Result set.
Summary and Results
The query is used to compare array entries to both fixed values and
field values. The query outputs the event that passed the filtering
condition in the pipeline.
In this example, the objectArray:exists()
function is used with the
condition argument and
array:exists() function to check if given
values are in the array.
The objectArray:exist() part
handles the structured part of the example, whereas the
array:exists() is used within the condition to loop
through the nested array. In a nested array, the outermost call must be
objectArray:exists(), the inner one could in theory
be either function, but LogScale recommends using
array:exists().
