Count Array Elements - Example 2
Query
queryParserMetrics.function[0] = "head"
| array:length("queryParserMetrics.function[]", as="_numberOfFunctions")
Introduction
Given an event that has the queryParserMetrics.function[] array fields (a list of the functions used in a query):
queryParserMetrics.function[0]="head" |
---|
queryParserMetrics.function[1]="bucket" |
queryParserMetrics.functions[2]="groupBy" |
Filters only events that has
head
as the value of
queryParserMetrics.function[]
array field, and then gets the number of functions listed in the
queryParserMetrics.function[]
array for that event.
Step-by-Step
Starting with the source repository events.
- flowchart LR; %%{init: {"flowchart": {"defaultRenderer": "elk"}} }%% repo{{Events}} 0[/Filter/] 1>Augment Data] result{{Result Set}} repo --> 0 0 --> 1 1 --> result style 0 fill:#ff0000,stroke-width:4px,stroke:#000;logscale
queryParserMetrics.function[0] = "head"
Filters events that has
head
as the value of queryParserMetrics.function[0] array field. - flowchart LR; %%{init: {"flowchart": {"defaultRenderer": "elk"}} }%% repo{{Events}} 0[/Filter/] 1>Augment Data] result{{Result Set}} repo --> 0 0 --> 1 1 --> result style 1 fill:#ff0000,stroke-width:4px,stroke:#000;logscale
| array:length("queryParserMetrics.function[]", as="_numberOfFunctions")
Counts the elements (the functions used) in all the
queryParserMetrics.function[]
arrays for that event. Event Result set.
Summary and Results
You will get an array of all the functions used in just one
event where head
is the first
function used. The result will be output into the
_numberOfFunctions field
set by the argument
as
.
_numberOfFunctions | 1 |