Pair functions

Function NameDescription
pair()Creates a pair from a key and value.
parse_pair()Parses a string to form a pair.

Each argument has a required section which is denoted with required or optional

  • If it’s denoted by required it means the argument must be passed into that function before it’ll work.
  • if it’s denoted by optional it means the function can work without passing the argument value.

pair()

Creates a pair from a key and value.

Arguments

NameTypeRequired or OptionalDescription
KeystringRequiredString for the key in the pair
ValuestringRequiredString for the value in the pair
SeparatorstringOptional (Default: ”:“)Separator between the key and value in the pair

Returns

Returns a pair with the key Key and the value Value with the separator Seperator.

Examples

pair("key", "value", ".")
['logs']
| where tags contains pair("host", "mymachine")

Run in Playground

parse_pair()

Creates a pair from a key and value.

Arguments

NameTypeRequired or OptionalDescription
PairstringRequiredString that has a pair of key value to pull out
SeparatorstringOptional (Default: ”:“)Separator between the key and value in the pair

Returns

Returns a pair with the key and value separated by the separator Seperator in Pair. If none is found a pair with the value of Pair and an empty key is returned.

Examples

parse_pair("key.value", ".")
['logs']
| where parse_pair(tags[0]).key == "host"

Run in Playground