bag_has_key

This page explains how to use the bag_has_key function in APL.

Use the bag_has_key function in APL to check whether a dynamic property bag contains a specific key. This is helpful when your data includes semi-structured or nested fields encoded as dynamic objects, such as JSON-formatted logs or telemetry metadata.

You often encounter property bags in observability data where log entries, spans, or alerts carry key–value metadata. Use bag_has_key to filter, conditionally process, or join such records based on the existence of specific keys, without needing to extract the values themselves.

For users of other query languages

If you come from other query languages, this section explains how to adjust your existing queries to achieve the same results in APL.

Splunk SPL users

In Splunk SPL, you often check whether a key exists in a JSON object using spath and conditional logic. APL simplifies this with bag_has_key, which returns a boolean directly and avoids explicit parsing.

Splunk example

| eval hasKey=if(isnull(spath(data, "keyName")), false, true)

ANSI SQL users

ANSI SQL doesn’t include native support for property bags or dynamic fields. You typically use JSON functions to access keys in JSON-formatted strings. In APL, dynamic fields are first-class, and bag_has_key provides direct support for key existence checks.

SQL example

SELECT *
FROM logs
WHERE JSON_EXTRACT(json_column, '$.keyName') IS NOT NULL

Usage

Syntax

bag_has_key(bag: dynamic, key: string) 

Parameters

Name	Type	Description
bag	dynamic	A dynamic value representing a property bag (e.g., JSON object).
key	string	The key to check for within the property bag.

Returns

Returns a bool value:

• true if the specified key exists in the property bag
• false otherwise

Use case examples

Log analysis

Use bag_has_key to filter log entries that include a specific metadata key embedded in a dynamic object.

Query

['sample-http-logs']
| extend metadata = bag_pack('source', 'cdn', 'env', 'prod')
| where bag_has_key(metadata, 'env')
| project _time, id, method, uri, status, metadata

Run in Playground

Output

_time	id	method	uri	status	metadata
2025-05-27T12:30Z	u123	GET	/login	200	{‘source’:‘cdn’,‘env’:‘prod’}
2025-05-27T12:31Z	u124	POST	/cart/checkout	500	{‘source’:‘cdn’,‘env’:‘prod’}

The query filters logs where the synthetic metadata bag includes the key 'env'.

Use bag_has_key to filter log entries that include a specific metadata key embedded in a dynamic object.

Query

['sample-http-logs']
| extend metadata = bag_pack('source', 'cdn', 'env', 'prod')
| where bag_has_key(metadata, 'env')
| project _time, id, method, uri, status, metadata

Run in Playground

Output

_time	id	method	uri	status	metadata
2025-05-27T12:30Z	u123	GET	/login	200	{‘source’:‘cdn’,‘env’:‘prod’}
2025-05-27T12:31Z	u124	POST	/cart/checkout	500	{‘source’:‘cdn’,‘env’:‘prod’}

The query filters logs where the synthetic metadata bag includes the key 'env'.

Use bag_has_key to filter spans that include specific dynamic span attributes.

Query

['otel-demo-traces']
| extend attributes = bag_pack('user', 'alice', 'feature_flag', 'beta')
| where bag_has_key(attributes, 'feature_flag')
| project _time, trace_id, span_id, ['service.name'], kind, attributes

Run in Playground

Output

_time	trace_id	span_id	[‘service.name’]	kind	attributes
2025-05-27T10:02Z	abc123	span567	frontend	client	{‘user’:‘alice’,‘feature_flag’:‘beta’}

The query selects spans with dynamic attributes bags containing the 'feature_flag' key.

Use bag_has_key to identify HTTP logs where the request metadata contains sensitive audit-related keys.

Query

['sample-http-logs']
| extend audit_info = bag_pack('action', 'delete', 'reason', 'admin_override')
| where bag_has_key(audit_info, 'reason')
| project _time, id, uri, status, audit_info

Run in Playground

Output

_time	id	uri	status	audit_info
2025-05-27T13:45Z	u999	/admin/delete	403	{‘action’:‘delete’,‘reason’:‘admin_override’}

The query returns only logs where the audit_info bag includes the 'reason' key, indicating administrative override events.

List of related functions

• bag_keys: Returns all keys in a dynamic property bag. Use it when you need to enumerate available keys.
• bag_pack: Converts a list of key-value pairs to a dynamic property bag. Use when you need to build a bag.