Docs
Open console →

array_extract

This page explains how to use the array_extract function in APL.

Use the array_extract function to extract specific values from a dynamic array using a JSON path expression. You can use this function to transform structured array data, such as arrays of objects, into simpler arrays of scalars. This is useful when working with nested JSON-like structures where you need to extract only selected fields for analysis, visualization, or filtering.

Use array_extract when:

  • You need to pull scalar values from arrays of objects.
  • You want to simplify a nested data structure before further analysis.
  • You are working with structured logs or metrics where key values are nested inside arrays.

Usage

Syntax

array_extract(sourceArray, jsonPath)

Parameters

NameTypeDescription
sourceArraydynamicA JSON-like dynamic array to extract values from.
jsonPathstringA JSON path expression to select values from the array.

Returns

A dynamic array of values that match the JSON path expression. The function always returns an array, even when the path matches only one element or no elements.

Use case examples

Use array_extract to retrieve specific fields from structured arrays, such as arrays of request metadata.

Query

['sample-http-logs']
| extend extracted_value = array_extract(dynamic([{'id': 1, 'value': true}, {'id': 2, 'value': false}]), @'$[*].value')
| project _time, extracted_value

Run in Playground

Output

_timeextracted_value
Jun 24, 09:28:10["true", "false"]
Jun 24, 09:28:10["true", "false"]
Jun 24, 09:28:10["true", "false"]

This query extracts the value field from an array of objects, returning a flat array of booleans in string form.

Use array_extract to extract service names from a nested structure—for example, collecting service.name from span records in a trace bundle.

Query

['otel-demo-traces']
| summarize traces=make_list(pack('trace_id', trace_id, 'service', ['service.name'])) by span_id
| extend services=array_extract(traces, @'$[*].service')

Run in Playground

Output

span_idservices
24157518330f7967[frontend-proxy]
209a0815d291d88a[currency]
aca763479149f1d0[frontend-web]

This query collects and extracts the service.name fields from a constructed nested structure of spans.

Use array_extract to extract HTTP status codes from structured log entries grouped into sessions.

Query

['sample-http-logs']
| summarize events=make_list(pack('uri', uri, 'status', status)) by id
| extend status_codes=array_extract(events, @'$[*].status')

Run in Playground

Output

idstatus_codes
user1[200]
user2[201]
user3[200]

This query extracts all HTTP status codes per user session, helping to identify patterns like repeated failures or suspicious behavior.

  • array_slice: Returns a subarray like array_extract, but supports negative indexing.
  • array_length: Returns the number of elements in an array. Useful before applying array_extract.
  • array_concat: Joins arrays end-to-end. Use before or after slicing arrays with array_extract.
  • array_index_of: Finds the position of an element in an array, which can help set the startIndex for array_extract.

Other query languages