Use the bag_zip function in APL to combine two arrays—one containing keys and another containing values—into a single dynamic property bag (dictionary). This is useful when you have parallel arrays that you want to merge into a structured key-value object for easier manipulation or output.

You typically use bag_zip when parsing data that arrives as separate lists of keys and values, or when transforming array-based structures into more readable dictionary formats. This function is especially helpful in log analysis, data transformation pipelines, and when preparing data for downstream systems that expect key-value pairs.

#For users of other query languages

If you come from other query languages, this section explains how to adjust your existing queries to achieve the same results in APL.

['sample-http-logs']
| extend keys = dynamic(['status', 'method', 'city'])
| extend values = dynamic(['200', 'GET', 'Seattle'])
| extend result = bag_zip(keys, values)

['sample-http-logs']
| extend keys = dynamic(['key1', 'key2'])
| extend values = dynamic([value1, value2])
| extend result = bag_zip(keys, values)

#Usage

#Syntax

bag_zip(keys, values)

#Parameters

#Returns

A dynamic property bag (dictionary) where each key from the keys array is paired with the corresponding value from the values array. If the arrays have different lengths, the function pairs elements up to the length of the shorter array and ignores any extra elements.

#Use case examples

['sample-http-logs']
| extend metadata_keys = dynamic(['status_code', 'request_method', 'city'])
| extend metadata_values = pack_array(status, method, ['geo.city'])
| extend request_metadata = bag_zip(metadata_keys, metadata_values)
| project _time, uri, request_metadata
| take 5

['otel-demo-traces']
| extend attr_keys = dynamic(['service', 'span_kind', 'status'])
| extend attr_values = pack_array(['service.name'], kind, status_code)
| extend span_attributes = bag_zip(attr_keys, attr_values)
| project _time, span_id, trace_id, span_attributes
| take 5

['sample-http-logs']
| extend security_keys = dynamic(['client_ip', 'country', 'http_status'])
| extend security_values = pack_array(id, ['geo.country'], status)
| extend security_context = bag_zip(security_keys, security_values)
| where status != '200'
| project _time, uri, method, security_context
| take 5

#List of related functions

• bag_pack: Use bag_pack when you have key-value pairs as separate arguments rather than arrays. Use bag_zip when working with parallel arrays.
• bag_keys: Use bag_keys to extract all keys from an existing property bag. Use bag_zip to create a new property bag from separate key and value arrays.
• pack_dictionary: Similar to bag_zip, but pack_dictionary takes alternating key-value arguments. Use bag_zip for array-based inputs.
• todynamic: Use todynamic to parse JSON strings into dynamic objects. Use bag_zip to construct dynamic objects programmatically from arrays.