Skip to main content

Select

Array Processing Data Extraction Element Selection

Synopsis​

An array processing processor that extracts a specific element from arrays by position, supporting both positive and negative indexing for flexible element selection from various array types including strings, integers, floats, and booleans.

Schema​

- select:
  field: <ident>
  position: <string>
  target_field: <ident>
  description: <text>
  if: <script>
  ignore_failure: <boolean>
  ignore_missing: <boolean>
  on_failure: <processor[]>
  on_success: <processor[]>
  tag: <string>

Configuration​

The following fields are used to define the processor:

FieldRequiredDefaultDescription
fieldY-Field containing the array to process
positionY-Position of element to select (0-based index)
target_fieldY-Field to store the selected element
descriptionN-Explanatory note
ifN-Condition to run
ignore_failureNfalseContinue if selection fails
ignore_missingNfalseContinue if source field doesn't exist
on_failureN-See Handling Failures
on_successN-See Handling Success
tagN-Identifier
disabledNfalseWhen true, the processor is skipped and the event continues to the next one. Lets you take a processor out of the path without removing its configuration

Details​

The processor supports multiple array types including string arrays, interface arrays, integer arrays, float arrays, and boolean arrays. Position indexing is zero-based with support for negative indices to count from the end of the array.

note

Negative indices allow selection from the end of arrays, where -1 represents the last element, -2 the second-to-last, and so on.

Array bounds checking ensures safe element access, returning errors for out-of-bounds positions rather than causing runtime panics. The processor validates that the target field is specified since element selection requires a destination.

Position validation ensures that the provided position is a valid integer value, supporting both positive and negative indexing for comprehensive array element access.

warning

The target_field parameter is required and must be specified to store the selected element.

Examples​

First Elements​

Selecting the first element from an array...

{
  "log_levels": ["ERROR", "WARN", "INFO", "DEBUG"],
  "ip_addresses": ["192.168.1.1", "10.0.0.1", "172.16.0.1"]
}
processors:
  - select:
    field: log_levels
    position: "0"
    target_field: primary_level
  - select:
    field: ip_addresses
    position: "0"
    target_field: primary_ip

extracts the first elements:

{
  "log_levels": ["ERROR", "WARN", "INFO", "DEBUG"],
  "ip_addresses": ["192.168.1.1", "10.0.0.1", "172.16.0.1"],
  "primary_level": "ERROR",
  "primary_ip": "192.168.1.1"
}

Last Elements​

Using negative indexing to select the last element...

{
  "file_parts": ["usr", "local", "bin", "application"],
  "scores": [85, 92, 78, 96, 88]
}
processors:
  - select:
    field: file_parts
    position: "-1"
    target_field: filename
  - select:
    field: scores
    position: "-1"
    target_field: latest_score

extracts the last elements:

{
  "file_parts": ["usr", "local", "bin", "application"],
  "scores": [85, 92, 78, 96, 88],
  "filename": "application",
  "latest_score": 88
}

Middle Elements​

Selecting elements from the middle of arrays...

{
  "tags": ["urgent", "security", "network", "firewall", "monitoring"],
  "timestamps": ["08:00", "09:15", "10:30", "11:45", "13:00"]
}
processors:
  - select:
    field: tags
    position: "2"
    target_field: category
  - select:
    field: timestamps
    position: "3"
    target_field: peak_time

extracts middle elements:

{
  "tags": ["urgent", "security", "network", "firewall", "monitoring"],
  "timestamps": ["08:00", "09:15", "10:30", "11:45", "13:00"],
  "category": "network",
  "peak_time": "11:45"
}

Boolean Arrays​

Selecting from boolean arrays...

{
  "test_results": [true, false, true, true, false],
  "feature_flags": [false, true, false, true]
}
processors:
  - select:
    field: test_results
    position: "0"
    target_field: first_test
  - select:
    field: feature_flags
    position: "-2"
    target_field: second_last_flag

extracts boolean values:

{
  "test_results": [true, false, true, true, false],
  "feature_flags": [false, true, false, true],
  "first_test": true,
  "second_last_flag": false
}

Multiple​

Selecting multiple elements from the same array...

{
  "url_parts": ["https:", "", "api.example.com", "v1", "users", "123"]
}
processors:
  - select:
    field: url_parts
    position: "0"
    target_field: protocol
  - select:
    field: url_parts
    position: "2"
    target_field: domain
  - select:
    field: url_parts
    position: "-1"
    target_field: user_id

extracts multiple components:

{
  "url_parts": ["https:", "", "api.example.com", "v1", "users", "123"],
  "protocol": "https:",
  "domain": "api.example.com",
  "user_id": "123"
}

Conditional​

Selecting elements based on conditions...

{
  "error_stack": ["DatabaseError", "ConnectionTimeout", "RetryExhausted"],
  "has_errors": true
}
processors:
  - select:
    field: error_stack
    position: "0"
    target_field: root_cause
    if: "has_errors == true"

applies selection when condition matches:

{
  "error_stack": ["DatabaseError", "ConnectionTimeout", "RetryExhausted"],
  "has_errors": true,
  "root_cause": "DatabaseError"
}