concatArray() Query Function

Concatenates the values of all fields with the same name and an array suffix into a value in a new field. Such array fields typically come as output from either parseJson() token or splitString() token.

All array fields starting with index from and ending with index to are selected. If some index is missing, the concatenation stops with the previous index, thus if only index 0, 1 and 3 are present, only index 0 and 1 are concatenated. If the first index is missing, no field is added to the event.

Parameters

Name

Type

Required

Default

Description

field

string

Yes

Base name for array fields to concatenate.

as

string

No

_concatArray

Name of output field.

from

number

No

0

First array index to include [0..∞].

to

number

No

Last array index to include (leave out to get all). Must be equal to or larger than from.

prefix

string

No

Prefix to prepend to the generated string.

separator

string

No

Separator between values.

suffix

string

No

Suffix to append to the generated string.

The implied parameter is field.

Examples

Concatenate the values of fields server[0], server[1] and so on and put it into a new field named _concatArray.

humio
concatArray(server)

Put the result into a field named servers.

humio
concatArray(server, as=servers)

Select only fields with indexes 1 to 3.

humio
concatArray(server, from=1, to=3)

Add a separator between concatenated values.

humio
concatArray(server, separator=", ")

Add a prefix and suffix to the generated string.

humio
concatArray(server, prefix="[", suffix="]")