ensure_field

Use the ensure_field function to safely access a field that may or may not exist in your data. The function returns the field’s value if it exists, or a typed nil if it doesn’t. This helps you write queries that work even when fields are missing, making your queries more robust and future-proof.

You typically use ensure_field when working with schemaless or evolving data where fields might be absent, or when you want to write queries that handle missing fields gracefully without errors.

Usage

Syntax

ensure_field(field_name, field_type)

Parameters

Returns

This function returns the value of the specified field if it exists, otherwise it returns a typed nil that matches the specified type.

Use case examples

['sample-http-logs']
| extend user_agent = ensure_field('user_agent', typeof(string))
| extend referer = ensure_field('referer', typeof(string))
| where isnotnull(user_agent) or isnotnull(referer)
| project _time, ['uri'], user_agent, referer

['otel-demo-traces']
| extend http_method = ensure_field('http.method', typeof(string))
| extend http_path = ensure_field('http.path', typeof(string))
| where ['kind'] == 'server'
| project _time, ['trace_id'], ['service.name'], http_method, http_path

List of related functions

• isnull: Checks if a value is null. Use isnull to test the result of ensure_field to determine if a field exists.
• isnotnull: Checks if a value isn't null. Use isnotnull to verify that ensure_field successfully retrieved a field value.
• coalesce: Returns the first non-null value from a list. Use coalesce with ensure_field to provide default values when fields are missing.

Other query languages