genai_concat_contents

You can use this function to create searchable conversation transcripts, prepare data for analysis, or consolidate conversation history for reporting.

Usage#

Syntax#

genai_concat_contents(messages, separator)

Parameters#

Name	Type	Required	Description
messages	dynamic	Yes	An array of message objects from a GenAI conversation. Each message typically contains a `role` and `content` field.
separator	string	No	The string used to separate message contents. Default is a space character (`' '`).

Returns#

Returns a string containing all message contents concatenated together with the specified separator.

Example#

Create a searchable conversation transcript from a GenAI conversation array.

Query

['otel-demo-genai']
| extend conversation_text = genai_concat_contents(['attributes.gen_ai.input.messages'], ' / ')

Run in Playground

Output

conversation_text
"Hello, how are you? / I'm good, thank you! / What's your name? / My name is John. / What's your favorite color? / My favorite color is blue. /"

This query concatenates the message contents of a GenAI conversation array with a separator of /.

genai_extract_user_prompt: Extracts only the user's prompt instead of all messages. Use this when you need just the user's input.
genai_extract_assistant_response: Extracts only the assistant's response. Use this when you need just the AI's output.
genai_get_content_by_role: Gets content filtered by a specific role. Use this when you need messages from a particular role like 'system' or 'tool'.
genai_message_roles: Extracts all message roles from a conversation. Use this to understand the conversation structure.
strcat_array: Concatenates a simple string array. Use this for non-GenAI arrays that don't have the message structure.

Other query languages#

Splunk SPL users

In Splunk SPL, you would typically use multiple eval commands with mvjoin to concatenate array values, but there’s no direct equivalent for extracting and joining message contents from nested structures.

Splunk example

| eval all_content=mvjoin(messages, " ")

APL equivalent

['ai-logs']
| extend all_content = genai_concat_contents(messages, ' ')

ANSI SQL users

In ANSI SQL, you would need to unnest the array and use STRING_AGG or similar functions to concatenate values, which is more verbose.

SQL example

SELECT
  conversation_id,
  STRING_AGG(content, ' ') as all_content
FROM conversations
CROSS JOIN UNNEST(messages) as msg
GROUP BY conversation_id