bag_zip
This page explains how to use the bag_zip function in APL.
Use the bag_zip function in APL to combine two arrays—one containing keys and another containing values—into a single dynamic property bag (dictionary). This is useful when you have parallel arrays that you want to merge into a structured key-value object for easier manipulation or output.
You typically use bag_zip when parsing data that arrives as separate lists of keys and values, or when transforming array-based structures into more readable dictionary formats. This function is especially helpful in log analysis, data transformation pipelines, and when preparing data for downstream systems that expect key-value pairs.
Usage
Syntax
Parameters
| Name | Type | Description |
|---|---|---|
keys | dynamic | An array of strings representing the keys for the resulting property bag. |
values | dynamic | An array of values corresponding to the keys. Can contain any data type. |
Returns
A dynamic property bag (dictionary) where each key from the keys array is paired with the corresponding value from the values array. If the arrays have different lengths, the function pairs elements up to the length of the shorter array and ignores any extra elements.
Use case examples
Use bag_zip to combine metadata keys and values extracted from HTTP logs into structured objects for easier analysis.
Query
Output
| _time | uri | request_metadata |
|---|---|---|
| 2025-05-26 10:15:30 | /api/user | {status_code: 200, request_method: GET, city: Seattle} |
| 2025-05-26 10:16:45 | /api/data | {status_code: 404, request_method: POST, city: Portland} |
This query creates structured metadata objects by zipping together field names and their corresponding values, making the data easier to export or process downstream.
Use bag_zip to construct custom span attributes from separate attribute name and value arrays in OpenTelemetry traces.
Query
Output
| _time | span_id | trace_id | span_attributes |
|---|---|---|---|
| 2025-05-26 11:20:15 | a1b2c3d4e5f6 | xyz123abc456 | {service: frontend, span_kind: server, status: OK} |
| 2025-05-26 11:21:30 | f6e5d4c3b2a1 | def789ghi012 | {service: cart, span_kind: client, status: OK} |
This query consolidates span-level metadata into structured attribute dictionaries, simplifying trace analysis and visualization.
Use bag_zip to create structured security context objects from arrays of security-related field names and values.
Query
Output
| _time | uri | method | security_context |
|---|---|---|---|
| 2025-05-26 12:30:00 | /admin/panel | POST | {client_ip: user123, country: CN, http_status: 403} |
| 2025-05-26 12:31:15 | /api/delete | DELETE | {client_ip: user456, country: RU, http_status: 401} |
This query creates structured security context for failed requests, making it easier to analyze security incidents and audit access patterns.
List of related functions
- bag_pack: Use
bag_packwhen you have key-value pairs as separate arguments rather than arrays. Usebag_zipwhen working with parallel arrays. - bag_keys: Use
bag_keysto extract all keys from an existing property bag. Usebag_zipto create a new property bag from separate key and value arrays. - pack_dictionary: Similar to
bag_zip, butpack_dictionarytakes alternating key-value arguments. Usebag_zipfor array-based inputs. - todynamic: Use
todynamicto parse JSON strings into dynamic objects. Usebag_zipto construct dynamic objects programmatically from arrays.