The array_select_dict function in APL allows you to retrieve a dictionary from an array of dictionaries based on a specified key-value pair. This function is useful when you need to filter arrays and extract specific dictionaries for further processing. If no match exists, it returns null. Non-dictionary values in the input array are ignored.
For users of other query languages
If you come from other query languages, this section explains how to adjust your existing queries to achieve the same results in APL.
The array_select_dict function in APL is similar to filtering objects in an array based on conditions in Splunk SPL. However, unlike Splunk, where filtering often applies directly to JSON structures, array_select_dict specifically targets arrays of dictionaries.
| project selected = array_select_dict(array, "key", 5)In ANSI SQL, filtering typically involves table rows rather than nested arrays. The APL array_select_dict function applies a similar concept to array elements, allowing you to extract dictionaries from arrays using a condition.
| project selected = array_select_dict(array_column, "key", 5)Usage
Syntax
array_select_dict(array, key, value)Parameters
| Name | Type | Description |
|---|---|---|
| array | dynamic | Input array of dictionaries. |
| key | string | Key to match in each dictionary. |
| value | scalar | Value to match for the specified key. |
Returns
The function returns the first dictionary in the array that matches the specified key-value pair. If no match exists, it returns null. Non-dictionary elements in the array are ignored.
Use case example
This example demonstrates how to use array_select_dict to extract a dictionary where the key service.name has the value frontend.
Query
['sample-http-logs']
| extend array = dynamic([{"service.name": "frontend", "status_code": "200"}, {"service.name": "backend", "status_code": "500"}])
| project selected = array_select_dict(array, "service.name", "frontend")Output
{"service.name": "frontend", "status_code": "200"}
This query selects the first dictionary in the array where service.name equals frontend and returns it.
List of related functions
- array_index_of: Finds the index of an element in an array.
- array_concat: Combines multiple arrays.
- array_rotate_right: Rotates array elements to the right by a specified number of positions.