Get the Last Element of an Array
Query
| index := array:length("foo[]")-1
| fieldName := format("foo[%s]", field=[index])
| result := getField(fieldName)
Introduction
Given an event with an array for field foo[x]:
foo['a','b','c','d']
Looks up the value of the field which is part of an array of
elements, using getField()
in combination
with expressions: first build the string with the field, then
perform getField()
in that string to get
the result.
Step-by-Step
Starting with the source repository events.
- flowchart LR; %%{init: {"flowchart": {"defaultRenderer": "elk"}} }%% repo{{Events}} 0[\Add Field/] 1[\Add Field/] 2[\Add Field/] result{{Result Set}} repo --> 0 0 --> 1 1 --> 2 2 --> result style 0 fill:#ff0000,stroke-width:4px,stroke:#000;logscale
| index := array:length("foo[]")-1
Sets the index as the last element of the array (in this case,
[6]
) - flowchart LR; %%{init: {"flowchart": {"defaultRenderer": "elk"}} }%% repo{{Events}} 0[\Add Field/] 1[\Add Field/] 2[\Add Field/] result{{Result Set}} repo --> 0 0 --> 1 1 --> 2 2 --> result style 1 fill:#ff0000,stroke-width:4px,stroke:#000;logscale
| fieldName := format("foo[%s]", field=[index])
Takes the field index and builds the string foo[6] using
format()
- flowchart LR; %%{init: {"flowchart": {"defaultRenderer": "elk"}} }%% repo{{Events}} 0[\Add Field/] 1[\Add Field/] 2[\Add Field/] result{{Result Set}} repo --> 0 0 --> 1 1 --> 2 2 --> result style 2 fill:#ff0000,stroke-width:4px,stroke:#000;logscale
| result := getField(fieldName)
Provides the value of the field whose name is foo[6]
Event Result set.
Summary and Results
The output is displayed as follows, where the last column shows the value of fieldName column (which is foo[3]) as the result:
@timestamp | @rawstring | @timestamp.nanos | fieldName | foo[0] | foo[1] | foo[2] | foo[3] | index | result |
---|---|---|---|---|---|---|---|---|---|
2024-03-01T08:43:12 | {"foo": ["a","b","c","d"]} | 0 | foo[3] | a | b | c | d | 3 | d |