Important

This function is considered experimental and under active development and should not be used in production.

The function must be enabled using the feature flag ArrayFunctions. See Enabling/Disabling Features.

Drops entries from the input array using the given filtering function.

The order is maintained in the output array. The name of the output array cannot be the same as the input array.

ParameterTypeRequiredDefaultDescription
arraystringtrue The prefix of the array in Humio, for example for events with fields 'incidents[0], incidents[1], ...' this would be 'incidents'. [a]
asstringfalse The output array; cannot be the same as the input array.
functionNon-aggregate functiontrue The function to use for filtering events in the array.
varstringtrue The function argument name

[a] When you provide only one parameter, the implied parameter is array

Examples

Given an array of three events retrieve those where the address starts with "ba":

logscale
mailto[0]=foo@example.com
mailto[1]=bar@example.com
mailto[2]=baz@example.com

Query function:

logscale
array:filter(mailto, var="addr", function={addr=ba*@example.com}, as=out)

Expected output:

logscale
out[0]=bar@example.com
out[1]=baz@example.com