concat( ) Query Function

Concatenates the values of a list of fields into a value in a new field.


Name Type Required Default Description
field [string] Yes Fields to concatenate
as string No _concat The output name of the field to set (defaults to _concat)

field is the unnamed parameter.


This example will concatenates the values of the fields f1 and f2 from each event into the field combined:

concat([f1, f2], as="combined")