join()

The join() function joins elements of a list to form a string. The function takes a JSON pointer, which represents the key to a list or map where values are of the list type, and joins the lists as strings using a delimiter. The default delimiter is a comma (,).

Parameters

The join function takes the following parameters:

• delimiter (string, optional): The string placed between elements. Examples: ,, `

  , ; . Default is ,`.

• pointer (required): A JSON pointer resolving to a list in the event.

Returns

The join command returns the following value:

• string: All elements concatenated using the specified delimiter.

Quick examples

• join("-", /labels) returns "prod-api-us" for labels: ["prod","api","us"]
• join(" | ", /authors) returns "Ada | Linus | Grace" for authors: ["Ada","Linus","Grace"]

Using join() in a pipeline

You can use join() inside processors that support value_expression, for example, the add_entries processor:

processor:
  - add_entries:
      entries:
        - key: labels_csv
          value_expression: join(" | ", /labels)

Example

The following pipeline ingests JSON events using an http source. It then uses add_entries with join() to build two new fields, labels_csv and authors_pipe:

join-demo:
  source:
    http:
      path: /events
      ssl: false
  processor:
    - add_entries:
        entries:
          - key: labels_csv
            value_expression: join(/labels) # Comma is used by default
          - key: authors_pipe
            value_expression: join(" | ", /authors)
  sink:
    - opensearch:
        hosts: ["https://opensearch:9200"]
        index: join-demo-%{yyyy.MM.dd}
        username: admin
        password: admin_password
        index_type: custom
        insecure: true  # set to true for self-signed local clusters

You can test the pipeline using the following command:

curl "http://localhost:2021/events" \
   -H "Content-Type: application/json" \
   -d '[
    {"message":"hello","labels":["prod","api","us"],"authors":["Ada","Linus","Grace"]},
    {"message":"world","labels":["stage","etl"],"authors":["Marie","Alan"]}
  ]'

The document stored in OpenSearch contains the following information:

{
  ...
  "hits": {
    "total": {
      "value": 2,
      "relation": "eq"
    },
    "max_score": 1,
    "hits": [
      {
        "_index": "join-demo-2025.11.06",
        "_id": "aGFyWZoBjfY5UoR7NC36",
        "_score": 1,
        "_source": {
          "message": "hello",
          "labels": [
            "prod",
            "api",
            "us"
          ],
          "authors": [
            "Ada",
            "Linus",
            "Grace"
          ],
          "labels_csv": "prod,api,us",
          "authors_pipe": "Ada | Linus | Grace"
        }
      },
      {
        "_index": "join-demo-2025.11.06",
        "_id": "aWFyWZoBjfY5UoR7NC36",
        "_score": 1,
        "_source": {
          "message": "world",
          "labels": [
            "stage",
            "etl"
          ],
          "authors": [
            "Marie",
            "Alan"
          ],
          "labels_csv": "stage,etl",
          "authors_pipe": "Marie | Alan"
        }
      }
    ]
  }
}