Axiom
Overview

array_extract

Use array_extract when:

  • You need to pull scalar values from arrays of objects.
  • You want to simplify a nested data structure before further analysis.
  • You are working with structured logs or metrics where key values are nested inside arrays.

Usage#

Syntax#

array_extract(sourceArray, jsonPath)

Parameters#

Name Type Description
sourceArray dynamic A JSON-like dynamic array to extract values from.
jsonPath string A JSON path expression to select values from the array.

Returns#

A dynamic array of values that match the JSON path expression. The function always returns an array, even when the path matches only one element or no elements.

Use case examples#

Use array_extract to retrieve specific fields from structured arrays, such as arrays of request metadata.

Query

['sample-http-logs']
| extend extracted_value = array_extract(dynamic([{'id': 1, 'value': true}, {'id': 2, 'value': false}]), @'$[*].value')
| project _time, extracted_value

Run in Playground

Output

_time extracted_value
Jun 24, 09:28:10 ["true", "false"]
Jun 24, 09:28:10 ["true", "false"]
Jun 24, 09:28:10 ["true", "false"]

This query extracts the value field from an array of objects, returning a flat array of booleans in string form.

Use array_extract to extract service names from a nested structure—for example, collecting service.name from span records in a trace bundle.

Query

['otel-demo-traces']
| summarize traces=make_list(pack('trace_id', trace_id, 'service', ['service.name'])) by span_id
| extend services=array_extract(traces, @'$[*].service')

Run in Playground

Output

span_id services
24157518330f7967 [frontend-proxy]
209a0815d291d88a [currency]
aca763479149f1d0 [frontend-web]

This query collects and extracts the service.name fields from a constructed nested structure of spans.

Use array_extract to extract HTTP status codes from structured log entries grouped into sessions.

Query

['sample-http-logs']
| summarize events=make_list(pack('uri', uri, 'status', status)) by id
| extend status_codes=array_extract(events, @'$[*].status')

Run in Playground

Output

id status_codes
user1 [200]
user2 [201]
user3 [200]

This query extracts all HTTP status codes per user session, helping to identify patterns like repeated failures or suspicious behavior.

  • array_slice: Returns a subarray like array_extract, but supports negative indexing.
  • array_length: Returns the number of elements in an array. Useful before applying array_extract.
  • array_concat: Joins arrays end-to-end. Use before or after slicing arrays with array_extract.
  • array_index_of: Finds the position of an element in an array, which can help set the startIndex for array_extract.

Other query languages#

Splunk SPL users

In Splunk SPL, you typically use spath with a wildcard or field extraction logic to navigate nested structures. APL’s array_extract uses JSON path syntax to extract array elements that match a given pattern.

Splunk example

| eval arr=mvappend("{\"id\":1,\"value\":true}", "{\"id\":2,\"value\":false}")
| spath input=arr path="{}.value" output=extracted_value

APL equivalent

['sample-http-logs']
| extend extracted_value = array_extract(dynamic([{'id': 1, 'value': true}, {'id': 2, 'value': false}]), @'$[*].value')
| project _time, extracted_value
ANSI SQL users

ANSI SQL doesn’t offer native support for JSON path queries on arrays in standard syntax. While some engines support functions like JSON_VALUE or JSON_TABLE, they operate on single objects. APL’s array_extract provides a concise and expressive way to query arrays using JSON path.

SQL example

SELECT JSON_EXTRACT(data, '$[*].value') AS extracted_value
FROM my_table;

APL equivalent

['sample-http-logs']
| extend extracted_value = array_extract(dynamic([{'id': 1, 'value': true}, {'id': 2, 'value': false}]), @'$[*].value')
| project _time, extracted_value

Updated

Was this page helpful?