array_select_dict

This page explains how to use the array_select_dict function in APL.

The array_select_dict function in APL allows you to retrieve a dictionary from an array of dictionaries based on a specified key-value pair. This function is useful when you need to filter arrays and extract specific dictionaries for further processing. If no match exists, it returns null. Non-dictionary values in the input array are ignored.

For users of other query languages

If you come from other query languages, this section explains how to adjust your existing queries to achieve the same results in APL.

Splunk SPL users

The array_select_dict function in APL is similar to filtering objects in an array based on conditions in Splunk SPL. However, unlike Splunk, where filtering often applies directly to JSON structures, array_select_dict specifically targets arrays of dictionaries.

Splunk example

| eval selected = mvfilter(array, 'key' == 5)

ANSI SQL users

In ANSI SQL, filtering typically involves table rows rather than nested arrays. The APL array_select_dict function applies a similar concept to array elements, allowing you to extract dictionaries from arrays using a condition.

SQL example

SELECT *
FROM my_table
WHERE JSON_CONTAINS(array_column, '{"key": 5}')

Usage

Syntax

array_select_dict(array, key, value)

Parameters

Name	Type	Description
array	dynamic	Input array of dictionaries.
key	string	Key to match in each dictionary.
value	scalar	Value to match for the specified key.

Returns

The function returns the first dictionary in the array that matches the specified key-value pair. If no match exists, it returns null. Non-dictionary elements in the array are ignored.

Use case example

This example demonstrates how to use array_select_dict to extract a dictionary where the key service.name has the value frontend.

Query

['sample-http-logs']
| extend array = dynamic([{"service.name": "frontend", "status_code": "200"}, {"service.name": "backend", "status_code": "500"}])
| project selected = array_select_dict(array, "service.name", "frontend")

Run in Playground

Output

{"service.name": "frontend", "status_code": "200"}

This query selects the first dictionary in the array where service.name equals frontend and returns it.

List of related functions

• array_index_of: Finds the index of an element in an array.
• array_concat: Combines multiple arrays.
• array_rotate_right: Rotates array elements to the right by a specified number of positions.