Abstract
Learn more about the Cortex Query Language arrayexpand
stage.
Syntax
arrayexpand <array_field> [limit <limit number>]
Description
The arrayexpand
stage expands the values of a mulit-value array field into separate events and creates one record in the result set for each item in the array, up to a <limit number>
of records.
Example
Suppose you have a dataset with a single row like this:
uid | username | array_values |
---|---|---|
123456 | ajohnson | [1,2,3,4,5,6,7,8,9,0] |
Then if you run an arrayexpand
stage using the array_values
field, with a limit of 3, the result set includes the following records:
dataset=my_dataset | arrayexpand array_values limit 3
uid | username | array_values |
---|---|---|
123456 | ajohnson | 2 |
123456 | ajohnson | 1 |
123456 | ajohnson | 3 |
Note
The result records created by arrayexpand
are in no particular order. However, you can use the sort stage to sort the results:
dataset=my_dataset | arrayexpand array_values | sort asc array_values