project

Learn how to select the fields to insert, rename, include, or drop and embeds new computed columns.

Selects the fields to insert, rename, include, or drop and embeds new computed columns.

Syntax

| project ColumnName [= Expression] [, ...]

| project FieldName, FieldName, FieldName, ...

or

| project [FieldName, FieldName[,] = Expression [, ...]

Arguments

name	type	description
Field Name(Column Name)	string	Name of a Field (column) to appear in the output. If there is no Expression, then Field Name is compulsory and a column of that name must appear in the input
Expression	expression	Optional scalar expression referencing the input columns.

Returns

A table that has the field named ‘arguments’ and as many rows as the input table.

Examples

['http-logs']
| project ['geo.country'] = ['id']

Run in Playground

['http-logs']
| project ['geo.country'] = ['id'], method = ['geo.city']

Run in Playground

['http-logs']
| project ['geo.city'], content_type, ['geo.country'], ['id'], is_tls

Run in Playground