array_concat

In log analysis, you can use array_concat to merge collections of user requests into a single array to analyze request patterns across different endpoints.

Query

['sample-http-logs']
| take 50
| summarize combined_requests = array_concat(pack_array(uri), pack_array(method))

Run in Playground

Output

This example concatenates the uri and method values into a single array for each log entry, allowing for combined analysis of access patterns and request methods in log data.

In OpenTelemetry traces, use array_concat to join span IDs and trace IDs for a comprehensive view of trace behavior across services.

Query

['otel-demo-traces']
| take 50
| summarize combined_ids = array_concat(pack_array(span_id), pack_array(trace_id))

Run in Playground

Output

This example creates an array containing both span_id and trace_id values, offering a unified view of the trace journey across services.

In security logs, array_concat can consolidate multiple IP addresses or user IDs to detect potential attack patterns involving different locations or users.

Query

['sample-http-logs']
| where status == '500'
| take 50
| summarize failed_attempts = array_concat(pack_array(id), pack_array(['geo.city']))

Run in Playground

Output

This query combines failed user IDs and cities where the request originated, allowing security analysts to detect suspicious patterns or brute force attempts from different regions.