make_bag() (aggregation function)

Returns a dynamic (JSON) property-bag (dictionary) of all the values of Expr in the group.

  • Can be used only in context of aggregation inside summarize

Syntax

make_bag (Expr [, MaxSize])

Arguments

  • Expr: Expression of type dynamic that is used for aggregation calculations.
  • MaxSize is an optional integer limit on the maximum number of elements returned. The default is 1048576. MaxSize value can't exceed 1048576.

Note

make_dictionary() is a legacy and obsolete version of make_bag(). The legacy version has a default limit of MaxSize = 128.

Returns

Returns a dynamic (JSON) property-bag (dictionary) of all the values of Expr in the group, which are property-bags. Non-dictionary values will be skipped. If a key appears in more than one row, an arbitrary value, out of the possible values for this key, will be selected.

See also

Use the bag_unpack() plugin for expanding dynamic JSON objects into columns that use property bag keys.

Examples

let T = datatable(prop:string, value:string)
[
    "prop01", "val_a",
    "prop02", "val_b",
    "prop03", "val_c",
];
T
| extend p = pack(prop, value)
| summarize dict=make_bag(p)

dict
{ "prop01": "val_a", "prop02": "val_b", "prop03": "val_c" }

Use the bag_unpack() plugin for transforming the bag keys in the make_bag() output into columns.

let T = datatable(prop:string, value:string)
[
    "prop01", "val_a",
    "prop02", "val_b",
    "prop03", "val_c",
];
T
| extend p = pack(prop, value)
| summarize bag=make_bag(p)
| evaluate bag_unpack(bag) 

prop01 prop02 prop03
val_a val_b val_c