This topic describes the syntax and examples of map functions.

The search and analytics feature of Log Service allows you to use map functions to analyze logs. The following table describes the supported map functions.
Function Description Example
Subscript operator ([]) Retrieves the value of a specified key from a map. -
histogram(x) Groups the values of the parameter x and calculates the count of each value. The syntax is equivalent to select count group by x.
Note The returned data is in the JSON format.
The statement latency > 10 | select histogram(status) is equivalent to the statement latency > 10 | select count(1) group by status.
histogram_u(x) Groups the values of the parameter x and calculates the count of each value.
Note The returned data is in the format of multiple rows and columns.
The statement latency > 10 | select histogram_u(status) is equivalent to the statement latency > 10 | select count(1) group by status.
map_agg(key,value) Returns a random value of the key in the format of a map that consists of key-value pairs. latency > 100 | select map_agg(method,latency)
multimap_agg(key,value) Returns all values of the key in the format of a map that consists of key-value pairs. latency > 100 | select multimap_agg(method,latency)
cardinality(x) → bigint Returns the cardinality of the map x. -
element_at(map<K, V>, key) → V Returns the value for the specified key. -
map() → map<unknown, unknown> Returns an empty map. -
map(array<K>, array<V>) → map<K,V> Returns a map where each key-value pair consists of two elements from two arrays. Each element is from one array. SELECT map(ARRAY[1,3], ARRAY[2,4]); - {1 -> 2, 3 -> 4}SELECT map(ARRAY[1,3], ARRAY[2,4]);-{1 -> 2, 3 -> 4}
map_from_entries(array<row<K, V>>) → map<K,V> Returns a map where each key-value pair consists of two elements from a multi-dimensional array. SELECT map_from_entries(ARRAY[(1, 'x'), (2, 'y')]); - {1 -> 'x', 2 -> 'y'}
map_concat(map1<K, V>, map2<K, V>, ..., mapN<K, V>) → map<K,V> Returns a map that is the union of all specified maps. If a key is found in multiple given maps, the value of the key in the returned map is the value of the key that occurs in the last given map. -
map_filter(map<K, V>, function) → map<K,V> For more information, see the map_filter function in Lambda functions. -
map_keys(x<K, V>) → array<K> Returns an array of keys in the specified map. -
map_values(x<K, V>) → array<V> Returns an array of values in the specified map. -