Filters events from the input array using the function provided in the array.

The order is maintained in the output array.

ParameterTypeRequiredDefaultDescription
array[a]stringrequired  The array name in Falcon LogScale array syntax, for example for events with fields incidents[0], incidents[1], ... this would be incidents[], as in array:filter(array="incidents[0]", ...).
asArraystringoptional[b]  The output array. Defaults to the value passed to the array parameter.
functionNon-aggregate functionrequired  The function to use for filtering events in the array.
varstringrequired  Name of the variable to be used in function argument.

[a] The argument name array can be omitted.

[b] Optional parameters use their default value unless explicitly set

Omitted Argument Names

The argument name for array can be omitted; the following forms of this function are equivalent:

logscale
array:filter("value[]",var="value",function="value")

and:

logscale
array:filter(array="value[]",var="value",function="value")

These examples show basic structure only; full examples are provided below.

Given an array of three elements, retrieve those where the address starts with ba:

logscale
mailto[0]=foo@example.com
mailto[1]=bar@example.com
mailto[2]=baz@example.com

Query function:

logscale
array:filter(array="mailto[]", var="addr", function={addr=ba*@example.com}, asArray="out[]")

Expected output:

logscale
out[0]=bar@example.com
out[1]=baz@example.com