unroll Unrolls a list by producing multiple events, one for each item.
Synopsis Description The unroll
operator transforms each input event into a multiple output events.
For each item in the input list, one output event is created, where the list is
replaced with its item. The surrounding data is kept as-is.
eyJ2ZXJzaW9uIjoiMSIsImVuY29kaW5nIjoiYnN0cmluZyIsImNvbXByZXNzZWQiOnRydWUsImVuY29kZWQiOiJ4nO1XbU/bMFx1MDAxMP7eX1x1MDAxMWVfUbDz4qR8K4XxomlcdTAwMWFiXHUwMDFi2ihCJnFTr66dxS4toP732SnEaVx1MDAxYTb2aUyilarcPXfn6/nuufah5ziuuiuIu+e4ZJliRrNcdTAwMTIv3Fx1MDAxZKO/JaWkgmvIr2Qp5mVaWU6UKuTe7i4uXG7PenmpmK09XHQjM8KV1LaXWnach+pTIzQz/seDo+ucgW83p9+/zI75XHUwMDA1+jmIv1auldFTQoosldUutSpcdTAwMDCglu9MYlxyeUEzNTG6XHUwMDEweaBcdTAwMWbEUY1MXGLNJ0pDsO/XSsxzZk6xXHUwMDAxpCrFlFxmXHUwMDA1XHUwMDEzpTn9XHUwMDFkJOZtXHUwMDEzuMHpNC/FnGfWJkFcdOkjazOmjJ2rO7YuXHUwMDEzTifzslx1MDAxMWF9wsVjorClr/2k0Fx1MDAwNbVe+sh8womUXHUwMDFiPqLAKVWmXGKwUVx1MDAwNJNfcZJVlb+yWZV4Rk5M6fmcsWZgnj1cdTAwMDbeXHUwMDAwJCHGOEBhXHUwMDA0XHUwMDAxgqhcdTAwMDZsS4SgrfwoeNVcdTAwMWTQXHUwMDA3IVxu/Fx1MDAwNCS1XHUwMDA1lVx1MDAwN7olVFx1MDAxNXSMmSS2piaFQ9suXHUwMDFiacyLXGavnWBcZoMk0bfahyCocUb5tO3DRDrtOKdqJV3ah1x1MDAxMXeckSvLdKTFkas7wlx1MDAwM57vwZG7s4YyqVxmdGkkI/sg0Fx1MDAxNlx1MDAxMFx1MDAwNp7/aGO0MNY+yIuRXHUwMDA3I9DUP8VcdTAwMGKDkWuUVyO+arSH4Oqc3pOqdTe07/GMMnObwUbOXHUwMDAzRnNTbpeRcWNcdTAwMTZ0yVx1MDAxNdVzV8NKXHUwMDE0XHUwMDE2TXU8TDkpt69cXJQ0p1x1MDAxY7PPr6NcdTAwMWX6XHUwMDA2yXE9nZ5f6Vc7XZyxP/+ApFx1MDAxY15cdTAwMWPBXHUwMDFm8nTRP1x1MDAxY2eKlducgctSLDZJI0o2SSPoIFxy2LiOmi6s6o0s/khcdTAwMTahXHUwMDFl+DhcdTAwMDaB3+ZcdTAwMDWNoS1lTVx1MDAxNiGMoiBcdTAwMDGxtfj3ZFFcYtpcXF7mZZ9cdTAwMWPbXHUwMDA0lVA/X+10Wjc6q2Xfa/m5XGZLNVx1MDAxNLNcdTAwMTlV+ot8Mkls1VrhUu1TnlGetzHCs2eQymtgXHUwMDA2Y0Lw1sVqvybmqpKu2/03w0iHanmAXHUwMDAwuL+eXHUwMDFm5cOzZJCdXHUwMDFkJy9Z4HHYWuBoe1x1MDAxNiNcdTAwMTh5yO9Y3/Hb9v6LgexD2EcoibtcdTAwMDbSXHUwMDBmn1x1MDAxYshcdTAwMDRcdTAwMDRcdTAwMTGCYfg6l3f3orJbqrWeViP+XHUwMDEyn9byeqlXc7W97lx1MDAxZP8/lK37p0DvkVx1MDAxZl39V+NcXOmG0uCai9xbSlx1MDAxNvtcdTAwMWRDPa5ehr0q7jJDTUx3Pqx6q1+kMz1cdTAwMTkifQ=={ "src": "192.0.2.1", "dst": [ "203.0.113.2", "172.16.76.150", "192.0.2.143" ] } {"src": "192.0.2.1", "dst": "203.0.113.2"} {"src": "192.0.2.1", "dst": "172.16.76.150"} {"src": "192.0.2.1", "dst": "192.0.2.143"}
No output events are produced if the list is empty or if the field is null
.
Examples Consider the following events:
{ "a" : 1 , "b" : [ 1 , 2 , 3 ]}
{ "a" : 2 , "b" : [ 1 ]}
{ "a" : 3 , "b" : []}
{ "a" : 4 , "b" : null }
unroll b
would produce the following output:
{ "a" : 1 , "b" : 1 }
{ "a" : 1 , "b" : 2 }
{ "a" : 1 , "b" : 3 }
{ "a" : 2 , "b" : 1 }
The unroll
operator can also be used with records.
{
"src" : "192.168.0.5" ,
"conn" : [
{
"dest" : "192.168.0.34" ,
"active" : "381ms"
},
{
"dest" : "192.168.0.120" ,
"active" : "42ms"
},
{
"dest" : "1.2.3.4" ,
"active" : "67ms"
}
]
}
We can use unroll conn
to bring this into a form more suited for analysis.
For example, we would then be able to use
where active > 100ms || conn.dest !in 192.168.0.0/16
to filter for relevant
connections.
{
"src" : "192.168.0.5" ,
"conn" : {
"dest" : "192.168.0.34" ,
"active" : "381.0ms"
}
}
{
"src" : "192.168.0.5" ,
"conn" : {
"dest" : "1.2.3.4" ,
"active" : "67.0ms"
}
}