Axiom
Overview

bag_has_key

You often encounter property bags in observability data where log entries, spans, or alerts carry key–value metadata. Use bag_has_key to filter, conditionally process, or join such records based on the existence of specific keys, without needing to extract the values themselves.

Usage#

Syntax#

bag_has_key(bag: dynamic, key: string)

Parameters#

Name Type Description
bag dynamic A dynamic value representing a property bag (for example, JSON object).
key string The key to check for within the property bag.

Returns#

Returns a bool value:

  • true if the specified key exists in the property bag
  • false otherwise

Use case examples#

Use bag_has_key to filter log entries that include a specific metadata key embedded in a dynamic object.

Query

['sample-http-logs']
| extend metadata = bag_pack('source', 'cdn', 'env', 'prod')
| where bag_has_key(metadata, 'env')
| project _time, id, method, uri, status, metadata

Run in Playground

Output

_time id method uri status metadata
2025-05-27T12:30Z u123 GET /login 200 {'source':'cdn','env':'prod'}
2025-05-27T12:31Z u124 POST /cart/checkout 500 {'source':'cdn','env':'prod'}

The query filters logs where the synthetic metadata bag includes the key 'env'.

Use bag_has_key to filter spans that include specific dynamic span attributes.

Query

['otel-demo-traces']
| extend attributes = bag_pack('user', 'alice', 'feature_flag', 'beta')
| where bag_has_key(attributes, 'feature_flag')
| project _time, trace_id, span_id, ['service.name'], kind, attributes

Run in Playground

Output

_time trace_id span_id ['service.name'] kind attributes
2025-05-27T10:02Z abc123 span567 frontend client {'user':'alice','feature_flag':'beta'}

The query selects spans with dynamic attributes bags containing the 'feature_flag' key.

Use bag_has_key to identify HTTP logs where the request metadata contains sensitive audit-related keys.

Query

['sample-http-logs']
| extend audit_info = bag_pack('action', 'delete', 'reason', 'admin_override')
| where bag_has_key(audit_info, 'reason')
| project _time, id, uri, status, audit_info

Run in Playground

Output

_time id uri status audit_info
2025-05-27T13:45Z u999 /admin/delete 403 {'action':'delete','reason':'admin_override'}

The query returns only logs where the audit_info bag includes the 'reason' key, indicating administrative override events.

  • bag_keys: Returns all keys in a dynamic property bag. Use it when you need to enumerate available keys.
  • bag_pack: Converts a list of key-value pairs to a dynamic property bag. Use when you need to build a bag.

Other query languages#

Splunk SPL users

In Splunk SPL, you often check whether a key exists in a JSON object using spath and conditional logic. APL simplifies this with bag_has_key, which returns a boolean directly and avoids explicit parsing.

Splunk example

| eval hasKey=if(isnull(spath(data, "keyName")), false, true)

APL equivalent

['sample-http-logs']
| where bag_has_key(dynamic_field, 'keyName')
ANSI SQL users

ANSI SQL doesn’t include native support for property bags or dynamic fields. You typically use JSON functions to access keys in JSON-formatted strings. In APL, dynamic fields are first-class, and bag_has_key provides direct support for key existence checks.

SQL example

SELECT *
FROM logs
WHERE JSON_EXTRACT(json_column, '$.keyName') IS NOT NULL

APL equivalent

['sample-http-logs']
| where bag_has_key(dynamic_field, 'keyName')

Updated

Was this page helpful?