unroll

Returns a new event for each member of a list or a record in an event, duplicating the surrounding event.

unroll [field:list|record]

Description

The unroll returns an event for each member of a specified list or record field, leaving the surrounding event unchanged.

Drops events where the specified field is an empty record, an empty list, or null.

field: list|record

Sets the name of the list or record field.

Examples

Unroll a list

from {x: "a", y: [1, 2, 3]},
     {x: "b", y: []},
     {x: "c", y: [4]}
unroll y

{x: "a", y: 1}
{x: "a", y: 2}
{x: "a", y: 3}
{x: "c", y: 4}

Unroll a record

from {x: "a", y: {foo: 1, baz: 2}},
     {x: "b", y: {foo: null, baz: 3}},
     {x: "c", y: null}
unroll y

{x: "a", y: {foo: 1}}
{x: "a", y: {baz: 2}}
{x: "b", y: {foo: null}}
{x: "b", y: {baz: 3}}

See Also

• fnflatten
• Enrich with threat intel
• Work with lookup tables