Count Array Elements - Example 1

Query

logscale
array:length("queryParserMetrics.function[]", as="_numberOfFunctions")

Introduction

Given an event that has multiple queryParserMetrics.function[] array fields (a list of the functions used in a query):

queryParserMetrics.function[0]="head"
queryParserMetrics.function[1]="bucket"
queryParserMetrics.functions[2]="groupBy"

We want to get the number of functions listed in the queryParserMetrics.function[] arrays for that event.

Step-by-Step

  1. Starting with the source repository events.

  2. flowchart LR; %%{init: {"flowchart": {"defaultRenderer": "elk"}} }%% repo{{Events}} 0>Augment Data] result{{Result Set}} repo --> 0 0 --> result style 0 fill:#ff0000,stroke-width:4px,stroke:#000;
    logscale
    array:length("queryParserMetrics.function[]", as="_numberOfFunctions")

    Counts the elements (the functions in the array) in the queryParserMetrics.function[] array field.

  3. Event Result set.

Summary and Results

The returned value is the number of functions found in the array, and it will be output into the _numberOfFunctions field, which is set by the argument as.

_numberOfFunctions3