Docs
Open console →

len

This page explains how to use the len function in APL.

Use the len function in APL (Axiom Processing Language) to determine the length of a string or the number of elements in an array. This function is useful when you want to filter, sort, or analyze data based on the size of a value—whether that’s the number of characters in a request URL or the number of cities associated with a user.

Use len when you need to:

  • Measure string lengths (for example, long request URIs).
  • Count elements in dynamic arrays (such as tags or multi-value fields).
  • Create conditional expressions based on the length of values.

Usage

Syntax

len(value)

Parameters

NameTypeDescription
valuestring or arrayThe input to measure—either a string or an array.

Returns

  • If value is a string, returns the number of characters.
  • If value is an array, returns the number of elements.
  • Returns null if the input is null.

Use case examples

Use len to find requests with long URIs, which might indicate poorly designed endpoints or potential abuse.

Query

['sample-http-logs']
| extend uri_length = len(uri)
| where uri_length > 100
| project _time, id, uri, uri_length

Run in Playground

Output

_timeiduriuri_length
2025-06-18T12:34:00Zuser123/api/products/search?query=...132
2025-06-18T12:35:00Zuser456/download/file/very/long/path/...141

The query filters logs for URIs longer than 100 characters and displays their lengths.

Use len to identify traces with IDs of unexpected length, which might indicate instrumentation issues or data inconsistencies.

Query

['otel-demo-traces']
| extend trace_id_length = len(trace_id)
| summarize count() by trace_id_length

Run in Playground

Output

trace_id_lengthcount
324987
1612

The query summarizes trace IDs by their lengths to find unexpected values.

Use len to analyze request methods and flag unusually short ones (e.g., malformed logs or attack vectors).

Query

['sample-http-logs']
| extend method_length = len(method)
| where method_length < 3
| project _time, id, method, method_length

Run in Playground

Output

_timeidmethodmethod_length
2025-06-18T13:10:00Zuser789P1
2025-06-18T13:12:00Zuser222G1

The query finds suspicious or malformed request methods that are unusually short.

  • array_length: Returns the number of elements in an array. Use this when working specifically with arrays.
  • array_slice: Returns a subarray like array_extract, but supports negative indexing.
  • array_concat: Joins arrays end-to-end. Use before or after slicing arrays with array_extract.

Other query languages