Find Union of Array Over multiple Events
Find union of an array over multiple events using the array:union()
function
Query
array:union(mailto, as=unique_mails)
Introduction
Arrays are handy when you want to work with multiple values of the same
data type. The array:union()
function is used to
find distinct values of an array over multiple events. One important
feature of UNION is, that it removes duplicate rows from the combined
data meaning if there are repetitions, then only one element occurrence
should be in the union.
Example incoming data might look like this:
mailto[0] | mailto[1] |
---|---|
foo@example.com | bar@example.com |
bar@example.com |
Step-by-Step
Starting with the source repository events.
- flowchart LR; %%{init: {"flowchart": {"defaultRenderer": "elk"}} }%% repo{{Events}} 0[\Add Field/] result{{Result Set}} repo --> 0 0 --> result style 0 fill:#ff0000,stroke-width:4px,stroke:#000;logscale
array:union(mailto, as=unique_mails)
Searches in the mailto array across multiple events and returns the union of element values in a new array, where the unique emails will appear only once. In this case creating a unique list of email addresses in a single array.
Event Result set.
Summary and Results
The query is used to search for and eliminate duplicates of e-mail addresses in arrays/combined datasets.
Sample output from the incoming example data:
unique_mails[0] | unique_mails[1] |
---|---|
bar@example.com | foo@example.com |