Expand the outer array

First you must expand the objects in the outer array.

Use the FROM command with an empty dataset literal to create a timestamp field called _time in the event. Use the SELECT command to specify several fields in the event, including a field called bridges for the array. Add the expand command to separate out the nested arrays by country.

The search to expand the outer array looks like this:

|FROM [{}] SELECT _time, [
   {famous_bridges: [{name: "Rialto Bridge", length: 157, city: "Venice"}, {name: "Ponte Vecchio Bridge", length: 276, city: "Florence"}], 
     country: "Italy"},
   {famous_bridges: [{name: "Hangzhou Bay Bridge", length: 110880, city:"Jiaxing"}, {name: "Nanpu Bridge", length: 27381, city:"Shanghai"}], 
     country: "China"}]
 AS bridges 
   | eval _time = now() 
   | expand bridges

The nested arrays becomes individual arrays. The results look like this:

The next step would be to flatten the fields in the bridges field.

Expand and flatten the nested array fields

To separate out the details for each bridge, you must expand and flatten the famous_bridges field, which contains the array.

Let's start with expanding the famous_bridges field.

...| flatten bridges | expand famous_bridges

When you expand the famous_bridges field, the results look like this:

Then add the flatten command to the end of the search:

...| flatten bridges | expand famous_bridges | flatten famous_bridges

When you flatten the famous_bridges field, the individual key-value pairs in the array are separated out into fields. The results look like this:

When you expand the famous_bridges field, the results look like this:

Removing unwanted fields in the output

When you expand and flatten arrays, especially nested arrays, you can end up with a lot of unnecessary fields in the output.

For example, in this set of results, the bridges and famous_bridges fields are not really necessary. The details from each object have been placed in individual fields:

...| flatten bridges | expand famous_bridges | flatten famous_bridges | SELECT _time, name, length, city, country

The order that you specify the fields with the SELECT command is the order that the fields appear in the output:

Converts multiple array values into separate events in a pipeline

The following example converts multiple array values into separate events in a pipeline.

Consider the following data in a single event:

To separate out each field, you can use the flatten command.

| flatten _raw     // PULLS OUT THE FIELDS IN THE EVENT

The resulting event looks like this:

However the records field contains an array with multiple objects. To pull out each object into it's own event, while retaining the other event data, use the eval and expand commands:

| flatten _raw  
| eval recordsField = _raw.records  // PULLS OUT EACH ARRAY OBJECT
| expand recordsField  // CREATES AN EVENT FOR EACH OBJECT
| fields - records  // REMOVES THIS FIELD FROM THE EVENTS

The resulting events looks like this:

The _raw, date, and host fields remain unchanged in each event, but now each object in the records field has been pulled out of the array and placed into the recordsField field.