array_select_dict

Usage#

Syntax#

array_select_dict(array, key, value)

Parameters#

Name	Type	Description
array	dynamic	Input array of dictionaries.
key	string	Key to match in each dictionary.
value	scalar	Value to match for the specified key.

Returns#

The function returns the first dictionary in the array that matches the specified key-value pair. If no match exists, it returns null. Non-dictionary elements in the array are ignored.

Use case example#

This example demonstrates how to use array_select_dict to extract a dictionary where the key service.name has the value frontend.

Query

['sample-http-logs']
| extend array = dynamic([{"service.name": "frontend", "status_code": "200"}, {"service.name": "backend", "status_code": "500"}])
| project selected = array_select_dict(array, "service.name", "frontend")

Run in Playground

Output

{"service.name": "frontend", "status_code": "200"}

This query selects the first dictionary in the array where service.name equals frontend and returns it.

array_index_of: Finds the index of an element in an array.
array_concat: Combines multiple arrays.
array_rotate_right: Rotates array elements to the right by a specified number of positions.

Other query languages#

Splunk SPL users

The array_select_dict function in APL is similar to filtering objects in an array based on conditions in Splunk SPL. However, unlike Splunk, where filtering often applies directly to JSON structures, array_select_dict specifically targets arrays of dictionaries.

Splunk example

| eval selected = mvfilter(array, 'key' == 5)

APL equivalent

| project selected = array_select_dict(array, "key", 5)

ANSI SQL users

In ANSI SQL, filtering typically involves table rows rather than nested arrays. The APL array_select_dict function applies a similar concept to array elements, allowing you to extract dictionaries from arrays using a condition.

SQL example

SELECT *
FROM my_table
WHERE JSON_CONTAINS(array_column, '{"key": 5}')