In this example, the objectArray:eval() function is used with itself to concatenate a deeply nested arrays of objects values in the array in[] and return the concatenated values in the output field out[].

Example incoming data might look like this:

The query is used to concatenate deeply nested arrays of objects. The use of this function in this way is often useful when incoming ingested data has been defined in a nested structure, but needs to be displayed or summarized. For example, importing the properties or configuration values may result in a list of potential values for a given property. Concatenating the values together makes them easier to use as a summary value for display in a table or graph.

Sample output from the incoming example data:

out[0]: 123
out[1]: 456

In this example, the concatArray() function concatenates the values of all fields with the same name into a value in a new defined field.

Example incoming data might look like this:

email[0] := "dopey"
email[1] := "sleepy"
email[2] := "doc"
email[3] := "happy"
email[4] := "sneezy"

The query is used to concatenate (join) two or more arrays into a new array. Concatenation is useful in programming and computing because it allows you to store and combine multiple pieces of data when needed.

Sample output from the incoming example data:

In this example, the concatArray() function concatenates the values of all fields with the same name into pipe separated values in a new field.

Example incoming data might look like this:

server[0] := "dopey"
server[1] := "sleepy"
server[2] := "doc"
server[3] := "happy"
server[4] := "sneezy"

The query is used to concatenate (join) the elements of the array into a new field where the concatenated values are separated by a pipe. Concatenation is useful in programming and computing because it allows you to store and combine multiple pieces of data when needed.

Sample output from the incoming example data:

In this example, the concatArray() function concatenates the values of all fields with the same name and an array suffix into a value in a new field, adding a prefix and a suffix to the generated output result.

Example incoming data might look like this:

server[0] := "dopey"
server[1] := "sleepy"
server[2] := "doc"
server[3] := "happy"
server[4] := "sneezy"

This can be useful to summarize or format a list of items for use in another part of the query.

Sample output from the incoming example data:

In this example, the concatArray() function concatenates the values of all fields with the same name into a value in a new field.

Example incoming data might look like this:

The query is used to concatenate (join) two or more arrays into a new array. Concatenation is useful in programming and computing because it allows you to store and combine multiple pieces of data when needed.

Sample output from the incoming example data:

In this example, the concatArray() function concatenates the values of all fields with the same name and index between 1 to 3 into a value in a new field.

Example incoming data might look like this:

server[0] := "dopey"
server[1] := "sleepy"
server[2] := "doc"
server[3] := "happy"
server[4] := "sneezy"

The query is used to concatenate (join) two or more arrays into a new array. Concatenation is useful in programming and computing because it allows you to store and combine multiple pieces of data when needed.

Sample output from the incoming example data:

In this example, the objectArray:eval() function is used to iterate over an array of key-value pair objects stored in the in[] array field, formatting each pair into a key=value string. The resulting strings are then concatenated into a single space-separated string, parsed with kvParse() to promote each key-value pair into a top-level field, and finally the intermediate working fields are removed using drop() and array:drop().

Example incoming data might look like this:

Each event contains an array of objects under the in[] field, where each object has a key and a value sub-field. The goal is to promote these dynamic key-value pairs into individual top-level fields on each event, regardless of what the key names are.

The query is used to flatten structured array data — where each array element is an object containing a key and a value sub-field — into individual top-level fields on each event. It achieves this by iterating over the array with objectArray:eval(), formatting each pair as a key=value string, concatenating the strings with concatArray(), parsing the result with kvParse(), and finally cleaning up the intermediate scalar field with drop() and the intermediate array field with array:drop().

This query is useful, for example, to normalize events from systems that emit dynamic or variable sets of attributes as arrays of key-value objects — such as configuration management tools, metadata APIs, or enrichment pipelines — so that the attributes can be used directly in filters, aggregations, and dashboards without requiring knowledge of the specific key names in advance.

Sample output from the incoming example data:

Note that each event only contains values for the fields that were present in its own in[] array — fields from other events are absent for that row, since the key names are dynamic and differ between events. The field names in the output are entirely determined by the values of the key sub-fields in the input array, making this pattern flexible for any set of dynamic attribute names.