How do i handle an array ?

[StefanSa]

Hi there,
have this here currently:

if exists(.source.ip) {
 .related.ip = [.source.ip]
}
if exists(.destination.ip) {
  .related.ip = [.destination.ip]
}

.related.ipcontains the array to be filled with .source.ipand .destination.ip.
How do i do that ?

[spencergilbert]

If I understand correctly you'd want to use append or push.

if exists(.source.ip) {
  .related.ip = push(.related.ip, .source.ip)
}
if exists(.destination.ip) {
  .related.ip = push(.related.ip, .destination.ip)
}

[StefanSa]

Hi @spencergilbert yes Spencer,
Thanks for your help

i get this error, "!" nor "err" help here.

 .related.ip = push(.related.ip, .destination.nat.ip)
   │  ------------- ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
   │  │             │
   │  │             this expression is fallible
   │  │             update the expression to be infallible
   │  or change this to an infallible assignment:
   │  .related.ip, err = push(.related.ip, .destination.nat.ip)

with this, no error

if exists(.source.ip) {
  .related.ip = push([.related.ip], [.source.ip])
}

but wrong json value:

"related":{"ip":[null,["192.168.1.254"]]}

i have run into this problem with append.
Therefore this question, how to do this with the array correctly.

[spencergilbert]

Ah - so it appears as though your .related.ip field is new/empty. If you're creating it yourself on the event, perhaps create it as an empty array first?

The error you're seeing is that the .related.ip field isn't guaranteed to be an array but the function requires that argument to be an array.

.related.ip = []
if exists(.source.ip) {
  .related.ip = push(.related.ip, .source.ip)
}
if exists(.destination.ip) {
  .related.ip = push(.related.ip, .destination.ip)
}

[StefanSa]

Perfect Spencer, thanks for the perfect support.
i would be happy if you could help me here too.
#10699

Best regards from Germany

[spencergilbert]

Perfect Spencer, thanks for the perfect support. i would be happy if you could help me here too. #10699

Best regards from Germany

Of course! I just left a comment there too - I think that one might be more involved though :)