Multi-value arrays in Tag Queries
Alert enrichment array improvements
Combine multi-value lookups with composition arrays to create powerfully dynamic enrichment. Ideal for situations when an alert relates to multiple services, entities, or resources, and in cases of nested dependencies. Read more about how to use arrays for automatic enrichment in Enrichment Map Lookup Tags and Composition Tag Templates.
Multi-value lookup tags
Lookup column values can be formatted as a single string value or an array. Each value must be formatted in standard JSON
When formatted as an array, each item within the array will be individually queried across the map, with one result value applied to the alert for each array item, according to the first match rules.
Nested arrays will be flattened, and arrays that cannot be parsed will be treated as a single string. Empty arrays will not be matched against.
Combine with Composition Tag template arrays for maximum flexibility in automatic tag enrichment.
Input Format | Example | Behavior |
JSON Array | [“a”,“b”,“c”] | Looks up each value, applies one result value per array item |
Nested Array | [[“a”,“b”],[“c”]] | Flattens, then looks up |
Single value | simple-string | Treats as one value |
CSV string | a,b,c | Treats as one value |
Empty array | [] | Returns no results |
Example Single String Values
"service_name":"UserService"
Queries single value: “UserService”
"location":"Building-5,Floor-3,Room-42"
Queries single value: “Building-5,Floor-3,Room-42”
"region": ["broken
Queries single value: “[\"broken”
Example JSON Arrays
Standard JSON array format with double quotes:
"affected_services":"["UserService","PaymentService","NotificationService"]"
Queries each value: ["UserService","PaymentService","NotificationService"]
"responsible_teams":"[["DevOps","SRE"],["Backend-Team"], "monitoring"]"
Queries each flattened value: [“DevOps”, “SRE”, “Backend-Team”, “monitoring”]
API object updates
Payload format:
{
“entity_ids”:“["entity1","entity2","entity3"]”
}Composition Rules using an array with nested template variables:
{
“type”:“COMPOSITION”,
“destination”:“service_list”,
"template":"[[\"web\", \"api\"], [\"${primary_service}\"]]",
"is_array":true
}→ Enrich alert with: “template”: ["web", "api", "primary_service_value"]
Default for is_array = false. The field will only be treated as an array if the is_array field is included and = true.
Multi-value composition tag templates
Composition enrichment templates can be formatted as a single string value, or an array.
When configured as an array, the template must be standard JSON format with double quotes, or the tag will not be enriched.
Each matched array item will be added to the array. Nested arrays will be flattened. Empty arrays will return no value.
Combine with Enrichment Map Lookup Tag arrays for maximum flexibility in automatic tag enrichment.
Example array value
{
"template":"["${primary_service}", "${backup_service}"]",
"is_array":true
}Creates array tag value: [“WebAPI”, “BackupAPI”]