object
Subcommands
| Subcommand | Description | Syntax |
|---|---|---|
obj | Creates an object with a single key/value pair | obj(<path>, <expr>) |
objget | Reads a value from an object using a dynamic or string path | objget(<object>, <path>) |
objset | Sets or replaces a value in an object using a dot-notation path | objset(<object>, <path>, <expr>) |
objmerge | Merges objects and path/value pairs into a new object | objmerge(<expr>, ...) |
objkeys | Returns the top-level keys of an object as a multivalue field | objkeys(<object>) |
objvalues | Returns the top-level values of an object as a multivalue field | objvalues(<object>) |
objlen | Returns the number of top-level keys in an object | objlen(<object>) |
Object paths use dot notation. When a path crosses an array of objects, object reads and sets apply to the matching object elements.
Examples
obj
Create an object with a nested path:
| eval request_info=obj("request.path", "/api")
This creates:
{"request":{"path":"/api"}}
objget
Read a nested value from an object using a path expression:
| eval path=objget(request_info, lookup_path)
For a fixed path, prefer dot notation:
| eval path=request_info.request.path
If the path crosses an array of objects, all matching values are returned as a multivalue field.
objset
Set or replace a nested value:
| eval edited=objset(request_info, "request.status", 200)
objset creates missing parent objects as needed. If an existing scalar value is used as a parent, it is replaced by the new child object.
For arrays of objects, objset updates each object element and leaves non-object elements unchanged:
| eval edited=objset(payload, "items.status", "ok")
objmerge
Merge objects recursively:
| eval merged=objmerge(obj("request.path", "/api"), obj("request.status", 200))
Merge path/value pairs into an object:
| eval merged=objmerge(request_info, "request.status", 200, "request.method", "GET")
When objmerge sees two object values for the same key, it recursively merges their children. When it sees different scalar values for the same path, it combines them into a multivalue field:
| eval merged=objmerge(obj("extra.child", "bar"), "extra.child", "baz")
This creates:
{"extra":{"child":["bar","baz"]}}
Merging the same scalar value for the same path is idempotent and does not create a duplicate value:
| eval merged=objmerge(obj("extra.child", "baz"), "extra.child", "baz")
When a child path is merged into an existing scalar parent, the parent value is preserved and combined with the new child object:
| eval edited=objset(obj("root", "foo"), "extra", "bar") merged=objmerge(edited, "extra.child", "baz")
This creates an extra value containing both the original scalar and the new child object:
{"root":"foo","extra":["bar",{"child":"baz"}]}
objkeys
Return the top-level keys of an object:
| eval keys=objkeys(request_info)
objvalues
Return the top-level values of an object:
| eval values=objvalues(request_info)
objlen
Return the number of top-level keys in an object:
| eval count=objlen(request_info)