Starting with the source repository events.

objectArray:eval("foo[]", var=x, function={_mapped := concat([x.key.value, "x.key.others[0]", "x.key.others[1]"])}, asArray="_mapped[]")

Notice that a var parameter can be used to give a different name to the input array variable inside the function argument. This is particularly useful whenever the input array name is very long.

Event Result set.

Starting with the source repository events.

objectArray:eval(
        "in[]",
        asArray="out[]",
        function={

Iterates over the array from start to end (or to the first empty index in the array, applies the given function, and returns the concatenated results in a new output array name field out[].

objectArray:eval("in.others[]", asArray="tmp[]", function={tmp := "in.others.d"})
| out := concatArray(tmp)
          }
          )

The nested objectArray:eval() performs the concatenation of the values within the nested array by calling the concatArray() function.

Notice that in the nested call to objectArray:eval(), the given input array name is the nested array in.others[]. This works because it is translated to the field in[i].others[] by the parent objectArray:eval() current array index i.

To return the concatenated array, the asArray parameter is set to the tmp[] field, and then when we assign the value of the concatenated value.

Event Result set.

Starting with the source repository events.

objectArray:eval("in[]", asArray="out[]", function={out := concat(["in.a", "in.b.c", "in.others[1].d"])})

Iterates over the array from start to end (or to the first empty index in the array), applies the given function, and returns the concatenated results in a new output array name field out[].

Event Result set.

Starting with the source repository events.

objectArray:eval("arr[]", var=x, function={_mapped := concat([x.a, x.b])}, asArray="_mapped[]")

Concatenates the values a and b from each array element and returns the results in a new array named _mapped. In this example, objectArray:eval() iterates over each element of the array and assigns each element to the variable x which is then used as an alias. The new field _mapped is created by concatenating the value using the alias x to extract each object value from each element of the array. Notice that the output in this example is a flat array.

For example, this array element:

is translated to:

_mapped[0]: a0b0

Event Result set.

Starting with the source repository events.

objectArray:eval(array="arrayToCount[]", asArray="tmpCountArray[]", function={ tmpCountArray:=true })

The objectArray:eval() function iterates over each element of the nested object array specified by the array parameter, here set to arrayToCount[].

For each element found, it evaluates the expression provided in the function parameter — in this case assigning the value true to a field named tmpCountArray, which will be an element of the output array. Note that the field name must match the array name specified in the asArray parameter.

The results are collected into a new flat array specified by the asArray parameter, named tmpCountArray[].

After this step, tmpCountArray[] contains one entry of true per element in the original nested array arrayToCount[], effectively creating a flat, countable representation of the nested array's length. Without this intermediate step, array:length() would be unable to count the elements because it does not operate on object-type (nested) arrays.

Note that the temporary array (in this example tmpCountArray[]) must have a unique name for each searched event. If the name is not unique, LogScale overwrites and drops existing fields from the event.

| array:length("tmpCountArray[]")

The array:length() function counts the number of elements in the flat array tmpCountArray[] that was created in the previous step. Because tmpCountArray[] is a flat array with one true entry per original nested element, this count accurately reflects the number of elements in the original nested array arrayToCount[]. The function returns the result in a new field named _length by default.

| array:drop("tmpCountArray[]")

Removes the temporary flat array tmpCountArray[] from the event. Since this array was only created as an intermediate step to enable counting, it is no longer needed once array:length() has returned the count in the _length field. Dropping it keeps the output clean and avoids polluting the results with intermediate fields.

Event Result set.

Starting with the source repository events.

| objectArray:eval(array="a[]", asArray="output[]", var="x", function={output := x.bar})

Iterates (creates a loop) over the array a[] and adds the value of the object .bar to a new array output[]. This is achieved by executing an anonymous function, which sets the value of output to the iterated value of x.bar from a[].

The asArray parameter is set to the output[] field, creating an array where each element contains the value of x.bar from the corresponding iteration.

Event Result set.

Starting with the source repository events.

objectArray:eval("in[]", asArray="out[]", function={out := format("%s:%s", field=[in.key, in.value])})

Iterates (executes a loop) over the array from start to end (or to the first empty index in the array), applies the given function, and returns the concatenated results in a new output array name field out[].

Notice that a var parameter can be used to give a different name to the input array variable inside the function argument. This is particularly useful whenever the input array name is very long. Example:

objectArray:eval("someVeryLongName[]", asArray="out[]",
var=x, function={out := format("%s:%s", field=[x.key,
x.value])})

Event Result set.

Starting with the source repository events.

objectArray:eval(array="in[]", asArray="kvpairs[]", function={
  kvpairs:=format("%s=%s", field=[in.key, in.value])
})

The objectArray:eval() function iterates over each element in the in[] array, as specified by the array parameter. The inner function block is applied to each element in turn. The asArray parameter specifies that the results of the inner function are collected into a new array named kvpairs[], updating the event with this new array field.

Inside the function block, the format() function constructs a string in the form key=value for each array element by referencing in.key and in.value — the sub-fields of each object in the in[] array. The result is assigned to kvpairs for each iteration, producing an array of formatted strings such as foo=bar, baz=qux, and zap=wham for the first event.

| concatArray("kvpairs", separator=" ")

The concatArray() function joins all elements of the kvpairs[] array into a single string, using a space character as the separator specified by the separator parameter. The result is returned in a new field named _concatArray, which is the default output field name for this function. For the first event, this produces a string such as foo=bar baz=qux zap=wham.

| kvParse(field="_concatArray")

The kvParse() function parses the space-separated key=value string stored in _concatArray, as specified by the field parameter. Each key-value pair found in the string is promoted to a top-level field on the event. For example, the string foo=bar baz=qux zap=wham results in three new fields: foo with value bar, baz with value qux, and zap with value wham. The default separator used by kvParse() is a space, which matches the output of the previous step.

| drop([_concatArray])

The drop() function removes the intermediate scalar field _concatArray from each event. This field was only needed as an intermediate representation during the parsing step and is no longer required in the final output.

| array:drop("kvpairs[]")

The array:drop() function removes the intermediate array field kvpairs[] from each event. This array was created by objectArray:eval() as a working structure to hold the formatted key=value strings and is no longer needed once parsing is complete. Using array:drop() rather than drop() is required here because kvpairs[] is an array field, and array fields must be removed with the dedicated array:drop() function.

Event Result set.