Provides the number of elements in an array.

ParameterTypeRequiredDefaultDescription
array[a]stringrequired  Name of the array. For example, incidents[].
asstringoptional[b]_length Name of field that contains the output length.

[a] The argument name array can be omitted.

[b] Optional parameters use their default value unless explicitly set

Omitted Argument Names

The argument name for array can be omitted; the following forms of this function are equivalent:

logscale
array:length("value[]")

and:

logscale
array:length(array="value[]")

Given an event with an array field like animals[]:

nohighlight
animals[0]: horse
animals[1]: duck
animals[2]: bunny

and the following query:

logscale
array:length("animals[]")

The result is the number of elements found in the animals[] array field (horse, duck and bunny ) for that event: 

_length: 3

Only array elements in sequential order are counted — if there is a gap in the array, the function assumes it is the end of the array.

For example, given the event:

nohighlight
animals[0]: horse
animals[1]: duck
animals[3]: bunny

The query counts the first two elements only, thus it will output: 

_length: 2

If applied to non-array input fields, the function returns 0.

Event:

nohighlight
#kind: logs

Query:

logscale
array:length("#kind")

Output: 

_length: 0

Counting Array Elements - Example 1

Query
flowchart LR; repo{{Events}} 0>Augment Data] result{{Result Set}} repo --> 0 0 --> result
logscale
array:length("queryParserMetrics.function[]", as="_numberOfFunctions")
Introduction

Given an event that has multiple queryParserMetrics.function[] array fields (a list of the functions used in a query):

Event 1 

|----------------------------------|-----------|
| queryParserMetrics.function [0]   | head     |                        
| queryParserMetrics.function [1]   | bucket   |
| queryParserMetrics.functions[2]   | groupBy  |
|---------------------------------- |----------|

We want to get the number of functions listed in the queryParserMetrics.function[] arrays for that event.

Step-by-Step

  1. Starting with the source repository events

  2. flowchart LR; repo{{Events}} 0>Augment Data] result{{Result Set}} repo --> 0 0 --> result style 0 fill:#ff0000,stroke-width:4px,stroke:#000;

    Count the elements (the functions in the array) in the queryParserMetrics.function[] array field.

    logscale
    array:length("queryParserMetrics.function[]", as="_numberOfFunctions")

  3. Event Result set

Summary and Results

The returned value is the number of functions found in the array, and it will be output into the _numberOfFunctions field, which is set by the argument as.

_numberOfFunctions3

Counting Array Elements - Example 2

Query
flowchart LR; repo{{Events}} 0[/Filter/] 1>Augment Data] result{{Result Set}} repo --> 0 0 --> 1 1 --> result
logscale
queryParserMetrics.function[0] = "head"
array:length("queryParserMetrics.function[]", as="_numberOfFunctions" )
Introduction

Given an event that has the queryParserMetrics.function[] array fields (a list of the functions used in a query):

Event 1 

|----------------------------------|-----------|
| queryParserMetrics.function[0]   | head     |                        
| queryParserMetrics.function[1]   | bucket   |
| queryParserMetrics.function[2]   | groupBy  |
|----------------------------------|----------|

Filter only events that has head as the value of queryParserMetrics.function[] array field, and then get the number of functions listed in the queryParserMetrics.function[] array for that event.

Step-by-Step

  1. Starting with the source repository events

  2. flowchart LR; repo{{Events}} 0[/Filter/] 1>Augment Data] result{{Result Set}} repo --> 0 0 --> 1 1 --> result style 0 fill:#ff0000,stroke-width:4px,stroke:#000;

    Filter events that has head as the value of queryParserMetrics.function[0] array field.

    logscale
    queryParserMetrics.function[0] = "head"
  3. flowchart LR; repo{{Events}} 0[/Filter/] 1>Augment Data] result{{Result Set}} repo --> 0 0 --> 1 1 --> result style 1 fill:#ff0000,stroke-width:4px,stroke:#000;

    Count the elements (the functions used) in all the queryParserMetrics.function[] arrays for that event.

    logscale
    array:length("queryParserMetrics.function[]", as="_numberOfFunctions" )

  4. Event Result set

Summary and Results

You will get an array of all the functions used in just one event where head is the first function used. The result will be output into the _numberOfFunctions field set by the argument as.