Concatenates the values of all fields with the same name and an array suffix into a value in a new field. Such array fields typically come as output from either parseJson() or splitString().

All array fields starting with index from and ending with index to are selected. If some index is missing, the concatenation stops with the previous index, thus if only index 0, 1 and 3 are present, only index 0 and 1 are concatenated. If the first index is missing, no field is added to the event.

ParameterTypeRequiredDefaultDescription
asstringfalse_concatArrayName of output field.
fieldstringtrue Base name for array fields to concatenate. [a]
fromnumberfalse0First array index to include [0..∞].
prefixstringfalse Prefix to prepend to the generated string.
separatorstringfalse Separator between values.
suffixstringfalse Suffix to append to the generated string.
tonumberfalse Last array index to include (leave out to get all). Must be equal to or larger than from.

[a] When you provide only one parameter, the implied parameter is field

Examples

Concatenate the values of fields server[0], server[1] and so on and put it into a new field named _concatArray.

logscale
concatArray(server)

Put the result into a field named servers.

logscale
concatArray(server, as=servers)

Select only fields with indexes 1 to 3.

logscale
concatArray(server, from=1, to=3)

Add a separator between concatenated values.

logscale
concatArray(server, separator=", ")

Add a prefix and suffix to the generated string.

logscale
concatArray(server, prefix="[", suffix="]")