Docs
Open console →

array_iff

Use the array_iff function in APL to filter arrays by a condition and select the corresponding values.

The array_iff function in Axiom Processing Language (APL) allows you to create arrays based on a condition. It returns an array with elements from two specified arrays, choosing each element from the first array when a condition is met and from the second array otherwise. This function is useful for scenarios where you need to evaluate a series of conditions across multiple datasets, especially in log analysis, trace data, and other applications requiring conditional element selection within arrays.

Usage

Syntax

array_iff(condition_array, array1, array2)

Parameters

  • condition_array: An array of boolean values, where each element determines whether to choose the corresponding element from array1 or array2.
  • array1: The array to select elements from when the corresponding condition_array element is true.
  • array2: The array to select elements from when the corresponding condition_array element is false.

Returns

An array where each element is selected from array1 if the corresponding condition_array element is true, and from array2 otherwise.

Use case examples

The array_iff function can help filter log data conditionally, such as choosing specific durations based on HTTP status codes.

Query

['sample-http-logs']
| order by _time desc
| limit 1000
| summarize is_ok = make_list(status == '200'), request_duration = make_list(req_duration_ms)
| project ok_request_duration = array_iff(is_ok, request_duration, 0)

Run in Playground

Output

ok_request_duration
[0.3150485097707766, 0, 0.21691408087847264, 0, 0.2757618582190533]

This example filters the req_duration_ms field to include only durations for the most recent 1,000 requests with status 200, replacing others with 0.

With OpenTelemetry trace data, you can use array_iff to filter spans based on the service type, such as selecting durations for server spans and setting others to zero.

Query

['otel-demo-traces']
| order by _time desc
| limit 1000
| summarize is_server = make_list(kind == 'server'), duration_list = make_list(duration)
| project server_durations = array_iff(is_server, duration_list, 0)

Run in Playground

Output

server_durations
["45.632µs", "54.622µs", 0, "34.051µs"]

In this example, array_iff selects durations only for server spans, setting non-server spans to 0.

In security logs, array_iff can be used to focus on specific cities in which HTTP requests originated, such as showing response durations for certain cities and excluding others.

Query

['sample-http-logs']
| limit 1000
| summarize is_london = make_list(['geo.city'] == "London"), request_duration = make_list(req_duration_ms)
| project london_duration = array_iff(is_london, request_duration, 0)

Run in Playground

Output

london_duration
[100, 0, 250]

This example filters the req_duration_ms array to show durations for requests from London, with non-matching cities having 0 as duration.

Other query languages