subarray()

Returns the subarray of a given array.

Syntax

subarray(ARRAY_EXPR, INT_START, [INT_END])
ARRAY_EXPR
Expression that retruns an array
INT_START
Start index of the array to be sliced. Index numbers start from 0.
INT_END
Last index of the array to be sliced. The element in the last index is not included in the subarray.

Description

Index of the array start from 0. If an array contains 5 elements, index numbers are 0, 1, 2, 3, 4 from left to right. You can also use negative number to index the elements. If an array contains 5 elements, index number is -5, -4, -3, -2, -1 from left to right.

Usage

  1. Typical example usages.

    json "{}"
    | eval parent=array(1, 2, 3, 4, 5)
    | eval child=subarray(parent, 2)
    | # Return value: 
        parent: [1, 2, 3, 4, 5]
        child: [3, 4, 5]
    
    json "{}"
    | eval arr=subarray(array(1, 2, 3, 4, 5), 2, 4)
    | # Return value: 
        arr: [3, 4]
    
    json "{}"
    | eval arr=subarray(array(1, 2, 3, 4, 5), 1, -1)
    | # Return value: 
        arr: [2, 3, 4]
    
  2. When INT_START or INT_END is specified outside valid range.

    json "{}"
    | eval arr=subarray(array(1, 2, 3, 4, 5), 5)
    | # Return value: null
    
    json "{}"
    | eval arr=subarray(array(1, 2, 3, 4, 5), 0, 5)
    | # Return value:
        arr: [1, 2, 3, 4, 5]