Pair functions

Learn how to use and combine different pair functions in APL

Pair functions

Function Name	Description
find_pair	Searches an array of key-value pairs and finds the first pair that matches the specified key and value patterns.
pair	Creates a pair from a key and value.
parse_pair	Parses a string to form a pair.

Each argument has a required section which is denoted with required or optional

• If it’s denoted by required it means the argument must be passed into that function before it’ll work.
• if it’s denoted by optional it means the function can work without passing the argument value.

pair

Creates a pair from a key and value.

Arguments

Name	Type	Required or Optional	Description
Key	string	Required	String for the key in the pair
Value	string	Required	String for the value in the pair
Separator	string	Optional (Default: ”:“)	Separator between the key and value in the pair

Returns

Returns a pair with the key Key and the value Value with the separator Seperator.

Examples

pair("key", "value", ".")

['logs']
| where tags contains pair("host", "mymachine")

parse_pair

Creates a pair from a key and value.

Arguments

Name	Type	Required or Optional	Description
Pair	string	Required	String that has a pair of key value to pull out
Separator	string	Optional (Default: ”:“)	Separator between the key and value in the pair

Returns

Returns a pair with the key and value separated by the separator Seperator in Pair. If none is found a pair with the value of Pair and an empty key is returned.

Examples

parse_pair("key.value", ".")

['logs']
| where parse_pair(tags[0]).key == "host"