bag_has_key

Use the bag_has_key function in APL to check whether a dynamic property bag contains a specific key. This is helpful when your data includes semi-structured or nested fields encoded as dynamic objects, such as JSON-formatted logs or telemetry metadata.

You often encounter property bags in observability data where log entries, spans, or alerts carry key–value metadata. Use bag_has_key to filter, conditionally process, or join such records based on the existence of specific keys, without needing to extract the values themselves.

Usage

Syntax

bag_has_key(bag: dynamic, key: string)

Parameters

Returns

Returns a bool value:

• true if the specified key exists in the property bag
• false otherwise

Use case examples

['sample-http-logs']
| extend metadata = bag_pack('source', 'cdn', 'env', 'prod')
| where bag_has_key(metadata, 'env')
| project _time, id, method, uri, status, metadata

['otel-demo-traces']
| extend attributes = bag_pack('user', 'alice', 'feature_flag', 'beta')
| where bag_has_key(attributes, 'feature_flag')
| project _time, trace_id, span_id, ['service.name'], kind, attributes

['sample-http-logs']
| extend audit_info = bag_pack('action', 'delete', 'reason', 'admin_override')
| where bag_has_key(audit_info, 'reason')
| project _time, id, uri, status, audit_info

List of related functions

• bag_keys: Returns all keys in a dynamic property bag. Use it when you need to enumerate available keys.
• bag_pack: Converts a list of key-value pairs to a dynamic property bag. Use when you need to build a bag.

Other query languages