Get the Last Element of an Array

Query

logscale
| index := array:length("foo[]")-1
| fieldName := format("foo[%s]", field=[index])
| result := getField(fieldName)

Introduction

Given an event with an array for field foo[x]:

foo['a','b','c','d']

Looks up the value of the field which is part of an array of elements, using getField() in combination with expressions: first build the string with the field, then perform getField() in that string to get the result.

Step-by-Step

  1. Starting with the source repository events.

  2. flowchart LR; %%{init: {"flowchart": {"defaultRenderer": "elk"}} }%% repo{{Events}} 0[\Add Field/] 1[\Add Field/] 2[\Add Field/] result{{Result Set}} repo --> 0 0 --> 1 1 --> 2 2 --> result style 0 fill:#ff0000,stroke-width:4px,stroke:#000;
    logscale
    | index := array:length("foo[]")-1

    Sets the index as the last element of the array (in this case, [6])

  3. flowchart LR; %%{init: {"flowchart": {"defaultRenderer": "elk"}} }%% repo{{Events}} 0[\Add Field/] 1[\Add Field/] 2[\Add Field/] result{{Result Set}} repo --> 0 0 --> 1 1 --> 2 2 --> result style 1 fill:#ff0000,stroke-width:4px,stroke:#000;
    logscale
    | fieldName := format("foo[%s]", field=[index])

    Takes the field index and builds the string foo[6] using format()

  4. flowchart LR; %%{init: {"flowchart": {"defaultRenderer": "elk"}} }%% repo{{Events}} 0[\Add Field/] 1[\Add Field/] 2[\Add Field/] result{{Result Set}} repo --> 0 0 --> 1 1 --> 2 2 --> result style 2 fill:#ff0000,stroke-width:4px,stroke:#000;
    logscale
    | result := getField(fieldName)

    Provides the value of the field whose name is foo[6]

  5. Event Result set.

Summary and Results

The output is displayed as follows, where the last column shows the value of fieldName column (which is foo[3]) as the result:

@timestamp@rawstring@timestamp.nanosfieldNamefoo[0]foo[1]foo[2]foo[3]indexresult
2024-03-01T08:43:12{"foo": ["a","b","c","d"]}0foo[3]abcd3d