explode

Creates a record for each element of the specified array or collection field. This command is generally used to pivot array (horizontal) data into row (vertical) format. If the specified field does not exist, is not an array, or is null, the original record is passed through unchanged.

Command properties

Syntax

Target

FIELD

Name of the array or collection field to expand. You must specify a field name.

Error codes

Parse errors

Runtime errors

N/A

Description

The explode command expands the array or collection value of the specified field into multiple records, one per element. Other fields from the original record are copied to all generated records.

If the specified field is not an array or collection, the original record is passed through unchanged. If the specified field is null or does not exist, the original record is also passed through unchanged.

Examples

1. Expand array fields and aggregate

   json "[{'line': '192.0.2.1 198.51.100.2'}, {'line': '198.51.100.2 203.0.113.3'}]"
   | eval ip = split(line, " ")
   | explode ip
   | stats count by ip
   

   Converts IP address strings separated by spaces into arrays using the split function, expands each IP into separate records using explode, and then counts the number of records per IP.

2. Expand parsed array fields into rows

   table duration=1h FIREWALL_LOG
   | parsejson
   | explode tags
   

   Parses JSON-formatted logs and expands each element of the tags array field into a separate record.