Important

This function must be enabled using the feature flag ArrayFunctions. See Enabling & Disabling Feature Flags.

Did you find this function useful? We are soliciting feedback on this function. Please use this form to provide input about how you've used the function and whether it met your needs.

Determines the set intersection of array values over input events. Use this to compute the values that occur in all events supplied to this function.

  • The output order of the values is not defined.

  • Empty arrays are ignored.

  • If no arrays are found, the output is empty.

ParameterTypeRequiredDefaultDescription
array[a]stringrequired  The prefix of the array in LogScale, for example for events with fields incidents[0], incidents[1], ... this would be incidents.
asstringoptional[b]_intersection The name of the output array

[a] The argument name array can be omitted.

[b] Optional parameters use their default value unless explicitly set

Omitted Argument Names

The argument name for array can be omitted; the following forms of this function are equivalent:

logscale
array:intersection("value[]")

and:

logscale
array:intersection(array="value[]")

Given two events with the fields:

logscale
mailto[0]=foo@example.com
mailto[1]=bar@example.com
mailto[0]=bar@example.com

Return the addresses present in all events:

logscale
array:intersection(mailto, as=unique_mails)

Expected result:

logscale
unique_mails[0]=bar@example.com