Filters events from the input array using the function provided in the array.

The order is maintained in the output array. The name of the output array cannot be the same as the input array.

ParameterTypeRequiredDefaultDescription
array[a]stringrequired  The array name in Falcon LogScale array syntax, for example for events with fields incidents[0], incidents[1], ... this would be incidents[], as in array:filter(array="incidents[0]", ...).
asArraystringoptional[b]  The output array. Defaults to the value passed to the array parameter.
functionNon-aggregate functionrequired  The function to use for filtering events in the array.
varstringrequired  Name of the variable to be used in function argument.

[a] The argument name array can be omitted.

[b] Optional parameters use their default value unless explicitly set

Omitted Argument Names

The argument name for array can be omitted; the following forms of this function are equivalent:

logscale
array:filter("value[]")

and:

logscale
array:filter(array="value[]")

Given an array of three elements, retrieve those where the address starts with ba:

logscale
mailto[0]=foo@example.com
mailto[1]=bar@example.com
mailto[2]=baz@example.com

Query function:

logscale
array:filter(array="mailto[]", var="addr", function={addr=ba*@example.com}, asArray="out[]")

Expected output:

logscale
out[0]=bar@example.com
out[1]=baz@example.com