This page explains how to use the bag_has_key function in APL.
bag_has_key
function in APL to check whether a dynamic property bag contains a specific key. This is helpful when your data includes semi-structured or nested fields encoded as dynamic objects, such as JSON-formatted logs or telemetry metadata.
You often encounter property bags in observability data where log entries, spans, or alerts carry key–value metadata. Use bag_has_key
to filter, conditionally process, or join such records based on the existence of specific keys, without needing to extract the values themselves.
Splunk SPL users
spath
and conditional logic. APL simplifies this with bag_has_key
, which returns a boolean directly and avoids explicit parsing.ANSI SQL users
bag_has_key
provides direct support for key existence checks.Name | Type | Description |
---|---|---|
bag | dynamic | A dynamic value representing a property bag (e.g., JSON object). |
key | string | The key to check for within the property bag. |
bool
value:
true
if the specified key exists in the property bagfalse
otherwisebag_has_key
to filter log entries that include a specific metadata key embedded in a dynamic object.Query_time | id | method | uri | status | metadata |
---|---|---|---|---|---|
2025-05-27T12:30Z | u123 | GET | /login | 200 | {‘source’:‘cdn’,‘env’:‘prod’} |
2025-05-27T12:31Z | u124 | POST | /cart/checkout | 500 | {‘source’:‘cdn’,‘env’:‘prod’} |
metadata
bag includes the key 'env'
.