concat()

The concat() function concatenates one or more arguments in order and returns them as a single string.

Syntax

Parameters

VALUE1, VALUE2, ...

The values to concatenate. Two or more arguments can be specified, with no limit on the number of arguments.

Description

The concat() function converts each argument to a string and concatenates them in order to return a string. How object arrays, lists, and maps such as those returned by array() are converted differs by series. In the 4.0 series starting with 4.0.2609.0, they are serialized to JSON format (for example, ["value1","value2"], {"key":"value"}) before being concatenated. In the 5.0 series (through 5.0.2605.2), they are converted by calling toString() instead, the same as all other values. Primitive arrays such as the byte[] returned by binary() are always converted by calling toString(), regardless of series. Any null values among the arguments are ignored and not included in the concatenation. Even if all arguments are null, an empty string ("") is returned.

Error codes

N/A

Usage examples

To prepare the WEB_APACHE_SAMPLE table used in these examples, refer to Preparing sample data.

1. Concatenate HTTP method and URI to form a request string

   table limit=5 WEB_APACHE_SAMPLE | eval result = concat(method, " ", uri) | fields method, uri, result
   | # result: "GET /feed", etc.
   

2. Concatenate HTTP method, URI, and protocol to reconstruct the request line

   table limit=5 WEB_APACHE_SAMPLE | eval result = concat(method, " ", uri, " ", protocol) | fields result
   | # result: "GET /feed HTTP/1.1", etc.
   

3. Null arguments are ignored

   json "{'a': 'foo', 'b': null, 'c': 'bar'}" | eval result = concat(a, b, c)
   | # result: "foobar"
   

4. All arguments are null

   json "{'a': null}" | eval result = concat(a)
   | # result: ""
   

5. Concatenating an array — format differs by series

   json "{}" | eval arr = array("a", "b") | eval result = concat("test message: ", arr)
   | # 5.0 series (through 5.0.2605.2) result: test message: [Ljava.lang.Object;@... (Java's default array toString())
   | # 4.0 series (4.0.2609.0 and later) result: test message: ["a","b"]
   

   In the 5.0 series (through 5.0.2605.2), the array is converted by calling toString(), producing the Java object's internal representation. In the 4.0 series starting with 4.0.2609.0, it is printed in JSON array format (["a","b"]) instead.

Change history