Skip to main content
Skip table of contents

Array Filters

LAST UPDATED: DECEMBER 23, 2025

array_pop(index)

Removes the element at the specified index from an array and returns the modified array. If the input array is empty, the operation will fail and return an error.

Examples - array_pop

EXAMPLE 1

Input:

CODE 
{% set quarantined_files = {"array": ["b7f9a3d2e4c6f8b92a47d5c1aa12bb34ef9c8902e2345ab19f37da7c1234eac1", 
                                      "9a81b02f4cc5b7a0fbc21c5a923e2d3aa87f02b5cc99e3311a9f7df25f91d2c4", 
                                      "a7d2c09fbd11e3b9b4a56f9320e57dfb88e5fa17d0b14a7bcd90a0f7adcefa91"]} %}
{{ quarantined_files.array | array_pop(0) }}

Return Data:

JSON 
[
  "9a81b02f4cc5b7a0fbc21c5a923e2d3aa87f02b5cc99e3311a9f7df25f91d2c4",
  "a7d2c09fbd11e3b9b4a56f9320e57dfb88e5fa17d0b14a7bcd90a0f7adcefa91"
]

EXAMPLE 2

Input:

CODE 
{% set phishing_domains = {"array": ["login-secure-verification.com", 
                                     "microsoft-updateportal.net", 
                                     "secure-accountreview.org"]} %}
{{ phishing_domains.array | array_pop(1) }}

Return Data:

JSON 
[
  "login-secure-verification.com",
  "secure-accountreview.org"
]

EXAMPLE 3

Input:

CODE 
{% set suspicious_processes = {"array": [4521, 8834, 1207, 3099]} %}
{{ suspicious_processes.array | array_pop(2) }}

Return Data:

JSON 
[
  4521,
  8834,
  3099
]

check_type(data)

Determines the data type of the provided value or variable. Supported types include:

  • array (list)

  • BlockReference

  • boolean (bool)

  • bytes

  • Cycler

  • dictionary / object (dict)

  • float

  • integer (int)

  • Joiner

  • LoopContext

  • Macro

  • Markup

  • Namespace

  • null / none (NoneType)

  • range

  • string (str)

  • TemplateReference

  • tuple

  • type

  • Undefined

Examples - check_type

EXAMPLE 1

Input:

CODE 
{{ 42 | check_type }}

Return Data:

TEXT 
int

EXAMPLE 2

Input:

CODE 
{% set cert_text = "-----BEGIN CERTIFICATE-----MIIBsjCCARugAwIBAgIU...-----END CERTIFICATE-----" %}
{% set cert_bytes = cert_text.encode("utf-8") %}
{{ cert_bytes | check_type }}

Return Data:

TEXT 
bytes

EXAMPLE 3

Input:

CODE 
{% set html_output = "<b>Alert Confirmed</b>" | safe %}
{{ html_output | check_type }}

Return Data:

TEXT 
Markup

EXAMPLE 4

Input:

CODE 
{% for i in [1, 2, 3] %}
  {{ loop | check_type }}
{% endfor %}

Return Data:

TEXT 
LoopContext

LoopContext

LoopContext

concat_arrays (array)

Joins the array before the pipe with the array specified in parentheses, preserving the order of elements from all input arrays.

Examples - concat_arrays

EXAMPLE 1

Input:

CODE 
{{ ["192.168.1.10", "10.0.0.5"] | concat_arrays(["172.16.0.8", "8.8.8.8"]) }}

Return Data:

JSON 
[
  "192.168.1.10",
  "10.0.0.5",
  "172.16.0.8",
  "8.8.8.8"
]

EXAMPLE 2

Input:

CODE 
{{ ["192.168.10.15", "10.0.0.25"] 
   | concat_arrays(["f9a8c1d2e3b4c5d6f7a8b9c0d1e2f3a4", "c3b2d9e8f1a0b4c6d7e8f9a1b2c3d4e"]) 
   | concat_arrays(["phishing_domain.com", "ransomware-domain.net"]) }}

Return Data:

JSON 
[
  "192.168.10.15",
  "10.0.0.25",
  "f9a8c1d2e3b4c5d6f7a8b9c0d1e2f3a4",
  "c3b2d9e8f1a0b4c6d7e8f9a1b2c3d4e",
  "phishing_domain.com",
  "ransomware-domain.net"
]

EXAMPLE 3

Input:

CODE 
{{ ["malware_hash_1", 443, true] | concat_arrays(["phishing_domain.com", null]) }}

Return Data:

JSON 
[
  "malware_hash_1",
  443,
  true,
  "phishing_domain.com",
  null
]

contains_array(search_array)

Returns a boolean indicating whether all elements in the search array are contained within the source array.

Examples - contains_array

EXAMPLE 1

Input:

CODE 
{% set authorized_users = ["Elon", "Bill", "Jack"] %}
{{ authorized_users | contains_array(["Elon", "Bill"]) }}

Return Data:

TEXT 
True

EXAMPLE 2

Input:

CODE 
{% set blocked_ips = ["192.168.1.5", "10.0.0.9", "172.16.0.4"] %}
{{ blocked_ips | contains_array(["192.168.1.5", "8.8.8.8"]) }}

Return Data:

TEXT 
False

contains_element(search_element)

Returns a boolean indicating whether the search element exists within the source array.

Examples - contains_element

EXAMPLE 1

Input:

CODE 
{% set users = ["Larry", "Mark", "Jeff"] %}
{{ users | contains_element("Mark") }}

Return Data:

TEXT 
True

EXAMPLE 2

Input:

CODE 
{% set domains = [
  "https://www.d3security.com",
  "https://www.google.com",
  "https://www.microsoft.com",
  "https://www.crowdstrike.com",
  "https://www.paloaltonetworks.com",
  "https://www.splunk.com"
] %}
{{ domains | contains_element("https://www.virustotal.com") }}

Return Data:

TEXT 
False

default(default_value)

Returns a fallback value when the provided variable is undefined or empty. If the input is defined, the original value is returned unchanged.

Examples - default

EXAMPLE 1

Input:

CODE 
{{ arr | default("Array is not defined.") }}

Return Data:

TEXT 
Array is not defined.

EXAMPLE 2

Input:

CODE 
{% set alert = {"type": "Phishing Email", "severity": "high"} %}
{{ alert.severity | default("medium") }}

Return Data:

TEXT 
high

Input:

CODE 
{% set alert = {"type": "Phishing Email", "severity": "high"} %}
{{ alert.non_existent_attribute | default("medium") }}

Return Data:

TEXT 
medium

EXAMPLE 3

Input:

CODE 
{% set data = 42 %}
{{ data | default("Variable is not defined.") }}

Return Data:

TEXT 
42

downcase(value_to_convert)

Converts all uppercase characters in the provided value to lowercase.

Examples - downcase

EXAMPLE 1

Input:

CODE 
{% set domains = [
  "D3SECURITY.COM",
  "GOOGLE.COM",
  "MICROSOFT.COM",
  "VIRUSTOTAL.COM"
] %}
{{ domains | downcase }}

Return Data:

TEXT 
[
  "d3security.com",
  "google.com",
  "microsoft.com",
  "virustotal.com"
]

EXAMPLE 2

Input:

CODE 
{{ "D3SECURITY" | downcase }}

Return Data:

TEXT 
d3security

EXAMPLE 3

Input:

CODE 
{% set data = {"A": "B", "C": "D"} %}
{{ data | downcase }}

Return Data:

TEXT 
{
  "a": "b",
  "c": "d"
}

equals(value)

Returns a Boolean that indicates whether the piped input and the comparison value are equivalent in content. Supports comparison of arrays, JSON objects, strings, and numbers.

Examples - equals

EXAMPLE 1

Input:

CODE 
{{ "D3Security" | equals("d3security") }}

Return Data:

TEXT 
False

EXAMPLE 2

Input:

CODE 
{% set alert1 = {
  "alert_id": "INC-48392",
  "threat_type": "phishing",
  "severity": "high",
  "source": "splunk"
} %}

{% set alert2 = {
  "alert_id": "INC-48392",
  "threat_type": "phishing",
  "severity": "high",
  "source": "splunk"
} %}

{{ alert1 | equals(alert2) }}

Return Data:

TEXT 
True

EXAMPLE 3

Input:

CODE 
{% set baseline_hashes = [
  "b7f9a3d2e4c6f8b92a47d5c1aa12bb34ef9c8902e2345ab19f37da7c1234eac1",
  "9a81b02f4cc5b7a0fbc21c5a923e2d3aa87f02b5cc99e3311a9f7df25f91d2c4",
  "a7d2c09fbd11e3b9b4a56f9320e57dfb88e5fa17d0b14a7bcd90a0f7adcefa91"
] %}

{% set recent_hashes = [
  "b7f9a3d2e4c6f8b92a47d5c1aa12bb34ef9c8902e2345ab19f37da7c1234eac1",
  "9a81b02f4cc5b7a0fbc21c5a923e2d3aa87f02b5cc99e3311a9f7df25f91d2c4",
  "a7d2c09fbd11e3b9b4a56f9320e57dfb88e5fa17d0b14a7bcd90a0f7adcefa91"
] %}

{{ baseline_hashes | equals(recent_hashes) }}

Return Data:

TEXT 
True

EXAMPLE 4

Input:

CODE 
{{ 3 | equals(3) }}
{{ 3 | equals('3') }}
{{ '3' | equals(3) }}

Return Data:

TEXT 
True
True
True

first

Returns the first element of an array or the first character of a string.

Examples - first

EXAMPLE 1

Input:

CODE 
{% set vendors = ["D3 Security", "CrowdStrike", "Palo Alto Networks"] %}
{{ vendors | first }}

Return Data:

TEXT 
D3 Security

EXAMPLE 2

Input:

CODE 
{{ "Threat" | first }}

Return Data:

TEXT 
T

get_count_by_grouped_field(grouping_key, count_field)

Returns an array of objects that each contain the 1) value corresponding to the specified top-level grouping key, and 2) the item count derived from the specified top-level count field, where arrays contribute their number of elements; objects contribute their number of fields; all other value types contribute 1; and objects missing the grouping key return empty objects.

Examples - get_count_by_grouped_field

EXAMPLE 1

Input:

CODE 
{% set arr = [
  {'key1': 'lorem ipsum'},
  {'key1': ['element1','element2']}
] %}
{{ arr | get_count_by_grouped_field("key1", "key1") }}

Return Data:

JSON 
[
  {
    "groupByFieldValue": "value1",
    "count": 1
  },
  {
    "groupByFieldValue": [
      "element1",
      "element2"
    ],
    "count": 2
  }
]

EXAMPLE 2

Input:

CODE 
{% set arr = [
  {'key1': 'value1', 'key2': ['element1','element2','element3']},
  {'key1': 'value2', 'key2': ['element1','element2','element3','element4']}
] %}
{{ arr | get_count_by_grouped_field('key1', 'key2') }}

Return Data:

JSON 
[
  {
    "groupByFieldValue": "value1",
    "count": 3
  },
  {
    "groupByFieldValue": "value2",
    "count": 4
  }
]

EXAMPLE 3

Input:

CODE 
{% set arr = [
  {"a": false}
] %}
{{ arr | get_count_by_grouped_field("a","a") }}

Return Data:

JSON 
[
  {
    "groupByFieldValue": false,
    "count": 1
  }
]

EXAMPLE 4

CODE 
{% set arr = [
  {"a": {"b":"c", "d":"e", "f":"g"}}
] %}
{{ arr | get_count_by_grouped_field("a","a") }}

Return Data:

JSON 
[
  {
    "groupByFieldValue": {
      "b": "c",
      "d": "e",
      "f": "g"
    },
    "count": 3
  }
]

EXAMPLE 5

CODE 
{% set arr = [
  {"a": "b"}
] %}
{{ arr | get_count_by_grouped_field("x","a") }}

Return Data:

JSON 
[
  {}
]

get_diff_in_text_arrays(array)

Compares two text arrays and returns an array of elements that are not common between them.

Examples - get_diff_in_text_arrays

EXAMPLE 1

Input:

CODE 
{% set array1 = ["a", "b", "c", "d", "e"] %}
{% set array2 = ["d", "e", "f", "g", "h"] %}
{{ array1 | get_diff_in_text_arrays(array2) }}

Return Data:

JSON 
[
  "a",
  "b",
  "c",
  "f",
  "g",
  "h"
]

EXAMPLE 2

Input:

CODE 
{% set array1 = [1, 2, 3, 4, 5] %}
{% set array2 = [4, 5, 6, 7, 8, 9] %}
{{ array1 | get_diff_in_text_arrays(array2) }}

Return Data:

JSON 
[
  1,
  2,
  3,
  6,
  7,
  8,
  9
]

EXAMPLE 3

Input:

CODE 
{% set array1 = ["a", "b", "c", 1, 2, 3] %}
{% set array2 = ["b", "c", "d", 3, 4, 5] %}
{{ array1 | get_diff_in_text_arrays(array2) }}

Return Data:

TEXT 
[
  1,
  2,
  4,
  5,
  "a",
  "d"
]

groupby(attribute_name)

Returns a sorted object array in which items are grouped by the specified top-level attribute (key).

Examples - groupby

EXAMPLE 1

Input:

CODE 
{% set arr = [
  {'x':'z'},
  {'x':'z'},
  {'x':'y'}
] %}
{{ arr | groupby('x') }}

Return Data:

JSON 
[
  {
    "y": [
      {
        "x": "y"
      }
    ]
  },
  {
    "z": [
      {
        "x": "z"
      },
      {
        "x": "z"
      }
    ]
  }
]

EXAMPLE 2

Input:

CODE 
{% set arr = [
  {'x':true},
  {'x':false},
  {'x':true}
] %}
{{ arr | groupby('x') }}

Return Data:

JSON 
[
  {
    "false": [
      {
        "x": false
      }
    ]
  },
  {
    "true": [
      {
        "x": true
      },
      {
        "x": true
      }
    ]
  }
]

EXAMPLE 3

Input:

CODE 
{% set arr = [
  {'x':1},
  {'x':0},
  {'x':1}
] %}
{{ arr | groupby('x') }}

Return Data:

JSON 
[
  {
    "0": [
      {
        "x": 0
      }
    ]
  },
  {
    "1": [
      {
        "x": 1
      },
      {
        "x": 1
      }
    ]
  }
]

join(separator_string)

Concatenates all elements in an array into a single string, inserting the specified separator between items.

Examples - join

EXAMPLE 1

Input:

CODE 
{% set letters = ["a", "b", "c"] %}
{{ letters | join(" ") }}

Return Data:

TEXT 
a b c

EXAMPLE 2

Input:

CODE 
{% set numbers = [192, 168, 200, 37] %}
{{ numbers | join(".") }}

Return Data:

TEXT 
192.168.200.37

EXAMPLE 3

Input:

CODE 
{% set x = {"seq": ["A", "B", 1, 2], "sep": "|"} %}
{{ x.seq | join(x.sep) }}

Return Data:

TEXT 
A|B|1|2

json_equal(value)

Returns a Boolean indicating whether two values are identical in structure and content.

Examples - json_equal

EXAMPLE 1

Input:

CODE 
{% set list1 = ["a", "b", "c"] %}
{% set list2 = ["c", "b", "a"] %}
{{ list1 | json_equal(list2) }}

Return Data:

TEXT 
False

EXAMPLE 2

Input:

CODE 
{% set dict1 = {"a": "z", "b": "y"} %}
{% set dict2 = {"a": "z", "c": "y"} %}
{{ dict1 | json_equal(dict2) }}

Return Data:

TEXT 
False

EXAMPLE 3

Input:

CODE 
{% set dict1 = {"a": "z", "b": "y"} %}
{% set dict2 = {"b": "y", "a": "z"} %}
{{ dict1 | json_equal(dict2) }}

Return Data:

TEXT 
True

jsonpath(json_path_string)

Filters JSON objects or arrays by evaluating expressions that match specific field values or conditions. The filter can reference data within the same task (intra-task) or from another task in the playbook (inter-task).

Examples - jsonpath

EXAMPLE 1

Input:

CODE 
{% set j = {
  "a": [
    {"x": 1, "y": 2},
    {"x": 3, "y": 4}
  ]
} %}
{{ j | jsonpath("$..a") }}

Return Data:

JSON 
[
  {
    "x": 1,
    "y": 2
  },
  {
    "x": 3,
    "y": 4
  }
]

EXAMPLE 2

Input:

CODE 
{% set j = {
  "a": [
    {"x": 1, "y": 2},
    {"x": 3, "y": 4}
  ]
} %}
{{ j | jsonpath("$.a[?(@.x == 1)]") }}

Return Data:

JSON 
{
  "x": 1,
  "y": 2
}

EXAMPLE 3

Input:

CODE 
{% set j = {
  "a": [
    {"x": 1, "y": 2},
    {"x": 3, "y": 4}
  ]
} %}
{{ j | jsonpath("$.a[?(@.x == 1)].y") }}

Return Data:

TEXT 
2

EXAMPLE 4

Frame 1-20251113-034313.png

Inputs:

CODE 
[
  {
    "x": 1,
    "y": 2
  },
  {
    "x": 3,
    "y": 4
  }
]
CODE 
{{ PlaybookData | jsonpath('$.Demo.returnData[?(@.x == 3)]') }}

Return Data:

TEXT 
{
  "x": 3,
  "y": 4
}
Frame 2-20251113-034841.png
Inter-Task JSONPath Referencing Schema

The general schema for inter-task JSONPath referencing is of the following structure:

CODE 
{{ PlaybookData | jsonpath('$.<TaskName>.<DataField>[<SubscriptExpression>]') }}

  • The <TaskName> segment identifies the specific task within the current playbook whose output or metadata is being referenced.

  • The <DataField> segment identifies where the relevant information resides. It is typically a top-level key (e.g., returnData or contextData), but can also include nested attributes separated by dots (e.g., taskExecution.startDate or taskExecution.duration.Minutes).

Frame 3 (1)-20251113-190832.png

  • The <SubscriptExpression> segment specifies how to traverse or extract elements from an array or object within a task's data node. It is always enclosed in square brackets and may include:

    • Indexes: Retrieves a single element by its zero-based index in the array.

      • Syntax: [n]
        EXAMPLE

        CODE 
        {{ PlaybookData | jsonpath('$.Demo.returnData[0]') }}

        Explanation: Retrieves the first element (object) in the returnData array.

    • Filter expressions: Retrieves array elements that satisfy a specified Boolean condition, such as matching a field value or logical comparison.

      • Syntax: [?()]
        EXAMPLE

        CODE 
        {{ PlaybookData | jsonpath('$.Demo.returnData[?(@.x == 3)]') }}

        Explanation: Retrieves the element from the returnData array where key x equals 3.

    • Wildcards: Retrieves all elements within an array or all keys within an object.

      • Syntax: [*]
        EXAMPLE

        CODE 
        {{ PlaybookData | jsonpath('$.Demo.returnData[*]') }}

        Explanation: Retrieves all elements (objects) from the returnData array.

    • Slice: Retrieves a subset of array elements by specifying a start and an end index. The end index is exclusive.

      • Syntax: [start:end]
        EXAMPLE

        CODE 
        {{ PlaybookData | jsonpath('$.Demo.returnData[1:3]') }}

        Explanation: Retrieves the returnData array elements from index 1 up to (but not including) index 3.

last

Returns the last element of an array or the final character of a string.

Examples - last

EXAMPLE 1

Input:

CODE 
{% set companies = ["Apple", "Microsoft", "Google"] %}
{{ companies | last }}

Return Data:

TEXT 
Google

EXAMPLE 2

Input:

CODE 
{% set company = "D3 Security Management Systems Inc." %}
{{ company | last }}

Return Data:

TEXT 
.

length

Returns the number of elements in an array, the number of characters in a string, or the number of key-value pairs in a JSON object.

Examples - length

EXAMPLE 1

Input:

CODE 
{{ ["a", "b"] | length }}

Return Data:

TEXT 
2

EXAMPLE 2

Input:

CODE 
{{ "abc" | length }}

Return Data:

TEXT 
3

EXAMPLE 3

Input:

CODE 
{% set obj = {"a": 1, "b": 2, "c": 3, "d": 4} %}
{{ obj | length }}

Return Data:

TEXT 
4

length_equals_to(integer)

Returns a boolean indicating whether the number of elements, characters, or key-value pairs in the input equals the specified length.

Examples - length_equals_to

EXAMPLE 1

Input:

CODE 
{{ [] | length_equals_to(0) }}

Return Data:

TEXT 
True

EXAMPLE 2

Input:

CODE 
{{ "D3 Security" | length_equals_to(11) }}

Return Data:

TEXT 
True

EXAMPLE 3

Input:

CODE 
{% set obj = {"a": 1, "b": 2, "c": 3} %}
{{ obj | length_equals_to(4) }}

Return Data:

TEXT 
False

list

Converts the piped input into a list. Returns a new list containing the elements of the input sequence, string, tuple, set, or dictionary keys if the input is an object.

Examples - list

EXAMPLE 1

Input:

CODE 
{{ "abc" | list }}

Return Data:

JSON 
[
  "a",
  "b",
  "c"
]

EXAMPLE 2

Input:

CODE 
{% set obj = {"x": 10, "y": 20} %}
{{ obj | list }}

Return Data:

JSON 
[
  "x",
  "y"
]

EXAMPLE 3

Input:

CODE 
{% set obj = {"x": 10, "y": 20} %}
{{ obj.values() | list }}

Return Data:

JSON 
[
  10,
  20
]

map(attribute_name)

Returns an array of values extracted from the input object array by the specified attribute name. Missing attributes return Undefined in the array.

Examples - map

EXAMPLE 1

Input:

CODE 
{{ [{'x':'D3'},{'x':'D3 Security'}] | map('x') }}

Return Data:

TEXT 
[
  "D3",
  "D3 Security"
]

EXAMPLE 2

Input:

CODE 
{% set arr = [
  {'x':{'y':'D3'}},
  {'x':{'y':'D3 Security'}},
  {'x':{'y':'D3 Security Management Systems'}}
] %}
{{ arr | map('x.y') }}

Return Data:

TEXT 
[
  "D3",
  "D3 Security",
  "D3 Security Management Systems"
]

EXAMPLE 3

Input:

CODE 
{{ [{'x':1},{'y':2}] | map('x') }}

Return Data:

TEXT 
[1, Undefined]

max

Returns the largest evaluated numeric value from a list or from the values of an object. Non-numeric data must not be present within the input, either as a list element or as an object key’s value.

Examples - max

EXAMPLE 1

Input:

CODE 
{{ [1, 2, 3] | max }}

Return Data:

TEXT 
3

EXAMPLE 2

Input:

CODE 
{% set nums = [2**5, 2**4, 2**3, 2**2] %}
{{ nums | max }}

Return Data:

TEXT 
32

EXAMPLE 3

Input:

CODE 
{{ {"a": 8, "b": 88.8, "c": 88} | max }}

Return Data:

TEXT 
88.8

min

Returns the smallest evaluated numeric value from a list or from the values of an object. Non-numeric data must not be present within the input, either as a list element or as an object key’s value.

Examples - min

EXAMPLE 1

Input:

CODE 
{{ [1, 2, 3] | min }}

Return Data:

TEXT 
1

EXAMPLE 2

Input:

CODE 
{% set nums = [2**5, 2**4, 2**3, 2**2] %}
{{ nums | min }}

Return Data:

TEXT 
4

EXAMPLE 3

Input:

CODE 
{{ {"a": 8, "b": 88.8, "c": 88} | min }}

Return Data:

TEXT 
8

not_contain_array(search_array)

Determines whether not all elements in the specified search array exist in the piped input source array. Returns True if at least one element in the search array is missing from the source array. Returns False if all elements are present.

Examples - not_contain_array

EXAMPLE 1

Input:

CODE 
{{ ["a","b","c"] | not_contain_array(["b"]) }}

Return Data:

TEXT 
False

EXAMPLE 2

Input:

CODE 
{{ ["x","y","z"] | not_contain_array(["y","q"]) }}

Return Data:

TEXT 
True

EXAMPLE 3

Input:

CODE 
{{ [1,2,3,4] | not_contain_array([5,1]) }}

Return Data:

TEXT 
True

not_contain_element(search_element)

Determines whether the specified search element is absent from the piped input source array. Returns True if the search element is absent from the source array. Returns False if the element is present.

Examples - not_contain_element

EXAMPLE 1

Input:

CODE 
{{ ["a","b","c"] | not_contain_element("b") }}

Return Data:

TEXT 
False

EXAMPLE 2

Input:

CODE 
{{ ["x","y","z"] | not_contain_element("q") }}

Return Data:

TEXT 
True

EXAMPLE 3

Input:

CODE 
{{ [1,2,3,4] | not_contain_element(5) }}

Return Data:

TEXT 
True

not_equal(comparison_value)

Returns a Boolean indicating whether the piped input differs from the comparison value.

Examples - not_equal

EXAMPLE 1

Input:

CODE 
{{ "a" | not_equal("b") }}

Return Data:

TEXT 
True

EXAMPLE 2

Input:

CODE 
{{ [1,2,3] | not_equal([1,2,3]) }}

Return Data:

TEXT 
False

EXAMPLE 3

Input:

CODE 
{% set object_a = {"id": 1} %}  
{% set object_b = {"id": 2} %}  
{{ object_a | not_equal(object_b) }}

Return Data:

TEXT 
True

plus(added_value)

Returns the sum for numeric inputs or a combined sequence for strings, arrays, or objects. For objects with shared keys, values from the added value override those in the piped input.

Examples - plus

EXAMPLE 1

Input:

CODE 
{{ [1,2,3] | plus([1,2]) }}

Return Data:

TEXT 
[
  1,
  2,
  3,
  1,
  2
]

EXAMPLE 2

Input:

CODE 
{% set numbers = {"a": 2, "b": 3} %}  
{{ numbers.a | plus(numbers.b) }}

Return Data:

JSON 
5

EXAMPLE 3

Input:

CODE 
{{ {"x":1,"y":2} | plus({"y":5,"z":9}) }}

Return Data:

JSON 
{
  "x": 1,
  "y": 5,
  "z": 9
}

EXAMPLE 4

Input:

CODE 
{{ 'D3' | plus( ' Security' ) }}

Return Data:

JSON 
D3 Security

random_element

Selects and returns a random element from the piped input sequence. Each element in the sequence has an equal probability of being chosen.

Examples - random_element

EXAMPLE 1

Input:

CODE 
{% set items = ["a","b","c"] %}  
{{ items | random_element }}

Return Data:

TEXT 
a

or

TEXT 
b

or

TEXT 
c

EXAMPLE 2

Input:

CODE 
{{ "abc" | random_element }}

Return Data:

TEXT 
a

or

TEXT 
b

or

TEXT 
c

EXAMPLE 3

Input:

CODE 
{% set obj = {"x": 10, "y": 20} %}
{{ obj.keys() | list | random_element }}     
{{ obj.values() | list | random_element }}

REFERENCE

See the list filter.

Return Data:

TEXT 
x
10

or

TEXT 
x
20

or

TEXT 
y
10

or

TEXT 
y
20

regex_extract_array(pattern, flag)

Returns all substrings from each element in the piped input text array that match the specified regular expression pattern as a list of matching text fragments. Optional flags include:

Flags

Function

I

Enables case-insensitive matching.

S

Allows the dot (.) to match newline characters.

X

Enables extended mode, allowing spaces and comments in the pattern for readability.

RELATED RESOURCE

Regular Expressions

Examples - regex_extract_array

EXAMPLE 1

Input:

CODE 
{% set texts = ["Port 80 open", "Port 443 closed", "Port 22 filtered"] %}
{{ texts | regex_extract_array("\d+") }}

See digits and + quantifier.

Return Data:

JSON 
[
  "80",
  "443",
  "22"
]

EXAMPLE 2

Input:

CODE 
{% set text_array = ["Demo", "DEMO", "demo"] %}
{{ text_array | regex_extract_array("demo", "I") }}

See literal matching.

Return Data:

JSON 
[
  "Demo",
  "DEMO",
  "demo"
]

EXAMPLE 3

Input:

CODE 
{% set text_array = ["D3\nSecurity", "D3\nASOC", "D3\nDocs"] %}
{{ text_array | regex_extract_array("D3\n[A-Za-z]+", "S") }}

See ranges.

Return Data:

JSON 
[
  "D3\nSecurity",
  "D3\nASOC",
  "D3\nDocs"
]

EXAMPLE 4

Input:

CODE 
{% set text_array = ["100", "2000", "D300", "400D"] %}
{{ text_array | regex_extract_array("
    \d{3}  # Exactly three digits
", "X") }}

See exact repetition.

Return Data:

JSON 
[
  "100",
  "200",
  "300",
  "400"
]

regex_group(pattern, flag, *group_num)

Returns one or more matched portions of text captured by parentheses-defined groups in a regular expression pattern

Examples - regex_group

EXAMPLE 1

Input:

CODE 
{{ "a.b.c" | regex_group("(\w+)\.(\w+)\.(\w+)", None, 2, 3) }}

See word characters.

Return Data:

JSON 
[
  "b",
  "c"
]

EXAMPLE 2

Input:

CODE 
{{ "X1-Y2" | regex_group("(\w+)-(\w+)", "I", 1, 2) }}

Return Data:

JSON 
[
  "X1",
  "Y2"
]

EXAMPLE 3

Input:

CODE 
{{ "Login FAILED for user EMusk" | regex_group("login\s+failed\s+for\s+user\s+(\w+)", "I", 1) }}

See whitespaces.

Return Data:

TEXT 
EMusk

regex_remove_array_item(pattern, flag)

Returns an array with all elements matching the regular expression pattern removed.

Examples - regex_remove_array_item

EXAMPLE 1

Input:

CODE 
{% set items = ["D3 SECURITY", "d3 security", "D3"] %}
{{ items | regex_remove_array_item("security", "I") }}

See literal matching.

Return Data:

JSON 
[
  "D3"
]

EXAMPLE 2

Input:

CODE 
{% set items = [
"MD5: 9f8a12ab33cdef998877aabbccddeeff",
  "SHA256: 88ff00cc11ddeeff2233445566778899aabbccddeeff00112233445566778899",
  "File: report.pdf",
  "Status: clean"
] %}
{{ items | regex_remove_array_item("^(File|Status):", None) }}

See start anchors and alternations.

Return Data:

JSON 
[
  "MD5: 9f8a12ab33cdef998877aabbccddeeff",
  "SHA256: 88ff00cc11ddeeff2233445566778899aabbccddeeff00112233445566778899"
]

EXAMPLE 3

Input:

CODE 
{% set companies = [
  "Akamai Technologies",
  "Amazon Web Services",
  "Apple",
  "Barracuda Networks",
  "Broadcom",
  "Check Point Software",
  "Cisco Systems",
  "CrowdStrike",
  "D3 Security",
  "Dell Technologies"
] %}
{{ companies | regex_remove_array_item("^(?!D)", None) }}

See (negative) lookaheads.

Return Data:

JSON 
[
  "D3 Security",
  "Dell Technologies"
]

regex_search_in_array(pattern, flag)

Returns an array containing the elements that match the regular expression pattern

Examples - regex_search_in_array

EXAMPLE 1

Input:

CODE 
{% set companies = [
  "D3 Security Management Systems Inc.", 
  "Dell Technologies Inc." ] %}
{{ companies | regex_search_in_array("d3", "I") }}

See literal matching.

Return Data:

JSON 
[
  "D3 Security Management Systems Inc."
]

EXAMPLE 2

Input:

CODE 
{% set ips = [
  "1.1.1.1",
  "8.8.8.8",
  "10.0.0.5",
  "192.0.2.45",
  "198.51.100.5",
  "203.0.113.10"
] %}
{{ ips | regex_search_in_array("^198\.51\.", None) }}

See escaping.

Return Data:

JSON 
[
  "198.51.100.5"
]

EXAMPLE 3

Input:

CODE 
{% set versions = [
  "D3 vSOC (v16.8)",
  "D3 vSOC (v16.9)",
  "D3 vSOC (v17.0)",
  "D3 vSOC (v17.1)",
  "D3 vSOC (v17.2)",
  "D3 vSOC (v17.3)",
  "D3 vSOC (v17.4)",
  "D3 vSOC (v17.5)",
  "D3 vSOC (v17.6)",
  "D3 vSOC (v17.7)",
  "D3 vSOC (v17.8)",
  "D3 vSOC (v17.9)",
  "D3 vSOC (v18.0)"
] %}
{{ versions | regex_search_in_array("D3 vSOC \(v((17\.[6-9])|(18\.0))\)") }}

See ranges, alternations and nested groups.

Return Data:

JSON 
[
  "D3 vSOC (v17.6)",
  "D3 vSOC (v17.7)",
  "D3 vSOC (v17.8)",
  "D3 vSOC (v17.9)",
  "D3 vSOC (v18.0)"
]

regex_split(pattern, max_split)

Returns an array of substrings by dividing the input text at positions matching a delimiter defined by a regular expression pattern. A max split value of 0 performs unlimited splitting.

Examples - regex_split

EXAMPLE 1

Input:

CODE 
{{ "D3 Security Management Systems Inc." | regex_split("\W+", 2) }}

See word characters.

Return Data:

JSON 
[
  "D3",
  "Security",
  "Management Systems Inc."
]

EXAMPLE 2

Input:

CODE 
{{ "A@B#C$D%E^F&G*H" | regex_split("\W+", 6) }}

Return Data:

JSON 
[
  "A",
  "B",
  "C",
  "D",
  "E",
  "F",
  "G*H"
]

EXAMPLE 3

Input:

CODE 
{{ "A1B2C3" | regex_split("\d+", 0) }}

See digits.

Return Data:

JSON 
[
  "A",
  "B",
  "C",
  ""
]

reject(test, comparator)

Returns an array containing elements from the piped input sequence that fail the specified test. The second parameter is only required for tests that need a comparator.

WHERE VERSUS REJECT

The where and reject filters are complementary opposites. See where.

Examples - reject

EXAMPLE 1

Input:

CODE 
{{ [-1, 0, 1, 2, 3] | reject(">=", 1) }}

Return Data:

JSON 
[
  -1,
  0
]

EXAMPLE 2

Input:

CODE 
{{ [1, 2, 3, 4, 5] | reject("lessthan", 2) }}

Return Data:

JSON 
[
  2,
  3,
  4,
  5
]

EXAMPLE 3

Input:

CODE 
{{ [1, True, 0, False] | reject("equalto", True) }}

Return Data:

JSON 
[
  0,
  false
]

EXAMPLE 4

Input:

CODE 
{{ [1, True, 0, False] | reject("sameas", True) }}

Return Data:

JSON 
[
  1,
  0,
  false
]

EXAMPLE 5

Input:

CODE 
{{ [1, 2, "three", 4] | reject("string") }}

Return Data:

JSON 
[
  1,
  2,
  4
]

EXAMPLE 6

Input:

CODE 
{{ [1, 2, "three", 4] | reject("number") }}

Return Data:

JSON 
[
  "three"
]

EXAMPLE 7

Input:

CODE 
{{ [1.1, 2, 3.333] | reject("float") }}

Return Data:

JSON 
[
  2
]

EXAMPLE 8

Input:

CODE 
{{ [1, "a", 2.5, null] | reject("integer") }}

Return Data:

JSON 
[
  "a",
  2.5,
  null
]

EXAMPLE 9

Input:

CODE 
{{ ["text", 1, 2.0, True] | reject("boolean") }}

Return Data:

JSON 
[
  "text",
  1,
  2.0
]

EXAMPLE 10

Input:

CODE 
{{ [
  [1, 2],
  (3, 4),
  "text",
  {"a": 1},
  range(3),
  5,
  3.14,
  True,
  None
] | reject("iterable") }}

Return Data:

JSON 
[
  5,
  3.14,
  true,
  null
]

EXAMPLE 11

Input:

CODE 
{{ [{"a":1}, [2,3], "string"] | reject("mapping") }}

Return Data:

JSON 
[
  [
    2,
    3
  ],
  "string"
]

EXAMPLE 12

Input:

CODE 
{{ [-3, -2,-1, 0, 1, 2, 3] | reject("odd") }}

Return Data:

JSON 
[
  -2,
  0,
  2
]

EXAMPLE 13

Input:

CODE 
{{ ["low", "medium", "high"] | reject("in", ["low", "medium"]) }}

Return Data:

JSON 
[
  "high"
]

EXAMPLE 14

Input:

CODE 
{{ [1, 2, 3, 4, 5] | reject("divisibleby", 2) }}

Return Data:

JSON 
[
  1,
  3,
  5
]

rejectattr(attribute, test, comparison)

Functions similarly to reject, but applies filtering to attributes (i.e., keys) of objects. The third parameter is only required for tests that need a comparator. When working with nested lists, each position in an inner list represents a column that can be referenced using zero-based indexing.

REJECTATTR VERSUS SELECTATTR

The rejectattr and selectattr filters are complementary opposites. See selectattr.

Examples - rejectattr

EXAMPLE 1

Input:

CODE 
{% set numbers = [
  {"value": -1},
  {"value": 0},
  {"value": 1},
  {"value": 2},
  {"value": 3}
] %}
{{ numbers | rejectattr("value", ">=", 1) }}

Return Data:

JSON 
[
  {
    "value": -1
  },
  {
    "value": 0
  }
]

EXAMPLE 2

Input:

CODE 
{{ [
  {"value": 1},
  {"value": 2},
  {"value": 3},
  {"value": 4},
  {"value": 5}
] | rejectattr("value", "lessthan", 2) }}

Return Data:

JSON 
[
  {
    "value": 2
  },
  {
    "value": 3
  },
  {
    "value": 4
  },
  {
    "value": 5
  }
]

EXAMPLE 3

Input:

CODE 
{{ [
  {"value": 1},
  {"value": true},
  {"value": 0},
  {"value": false}
] | rejectattr("value", "equalto", true) }}

Return Data:

JSON 
[
  {
    "value": 0
  },
  {
    "value": false
  }
]

EXAMPLE 4

Input:

CODE 
{{ [
  {"value": 1},
  {"value": true},
  {"value": 0},
  {"value": false}
] | rejectattr("value", "sameas", true) }}

Return Data:

JSON 
[
  {
    "value": 1
  },
  {
    "value": 0
  },
  {
    "value": false
  }
]

EXAMPLE 5

Input:

CODE 
{{ [
  {"data": 1},
  {"data": 2},
  {"data": "three"},
  {"data": 4}
] | rejectattr("data", "string") }}

Return Data:

JSON 
[
  {
    "data": 1
  },
  {
    "data": 2
  },
  {
    "data": 4
  }
]

EXAMPLE 6

Input:

CODE 
{{ [
  {"data": 1},
  {"data": 2},
  {"data": "three"},
  {"data": 4}
] | rejectattr("data", "number") }}

Return Data:

JSON 
[
  {
    "data": "three"
  }
]

EXAMPLE 7

Input:

CODE 
{{ [
  {"num": 1.1},
  {"num": 2},
  {"num": 3.333}
] | rejectattr("num", "float") }}

Return Data:

JSON 
[
  {
    "num": 2
  }
]

EXAMPLE 8

Input:

CODE 
{{ [
  {"val": 1},
  {"val": "a"},
  {"val": 2.5},
  {"val": null}
] | rejectattr("val", "integer") }}

Return Data:

JSON 
[
  {
    "val": "a"
  },
  {
    "val": 2.5
  },
  {
    "val": null
  }
]

EXAMPLE 9

Input:

CODE 
{{ [
  {"item": "text"},
  {"item": 1},
  {"item": 2.0},
  {"item": true}
] | rejectattr("item", "boolean") }}

Return Data:

JSON 
[
  {
    "item": "text"
  },
  {
    "item": 1
  },
  {
    "item": 2.0
  }
]

EXAMPLE 10

Input:

CODE 
{{ [
  {"data": [1, 2]},
  {"data": (3, 4)},
  {"data": "text"},
  {"data": {"a": 1}},
  {"data": range(3)},
  {"data": 5},
  {"data": 3.14},
  {"data": true},
  {"data": null}
] | rejectattr("data", "iterable") }}

Return Data:

JSON 
[
  {
    "data": 5
  },
  {
    "data": 3.14
  },
  {
    "data": true
  },
  {
    "data": null
  }
]

EXAMPLE 11

Input:

CODE 
{{ [
  {"data": {"a": 1}},
  {"data": [2, 3]},
  {"data": "string"}
] | rejectattr("data", "mapping") }}

Return Data:

JSON 
[
  {
    "data": [
      2,
      3
    ]
  },
  {
    "data": "string"
  }
]

EXAMPLE 12

Input:

CODE 
{{ [
  {"n": -3},
  {"n": -2},
  {"n": -1},
  {"n": 0},
  {"n": 1},
  {"n": 2},
  {"n": 3}
] | rejectattr("n", "odd") }}

Return Data:

JSON 
[
  {
    "n": -2
  },
  {
    "n": 0
  },
  {
    "n": 2
  }
]

EXAMPLE 13

Input:

CODE 
{{ [
  {"level": "low"},
  {"level": "medium"},
  {"level": "high"}
] | rejectattr("level", "in", ["low", "medium"]) }}

Return Data:

JSON 
[
  {
    "level": "high"
  }
]

EXAMPLE 14

Input:

CODE 
{{ [
  {"num": 1},
  {"num": 2},
  {"num": 3},
  {"num": 4},
  {"num": 5}
] | rejectattr("num", "divisibleby", 2) }}

Return Data:

JSON 
[
  {
    "num": 1
  },
  {
    "num": 3
  },
  {
    "num": 5
  }
]

EXAMPLE 15

Input:

CODE 
{% set data = [
  ["key1", "value1"],
  ["key2", "value2"],
  ["key3", "value3"]
] %}

{{ data | rejectattr("1", "equalto", "value2") }}

Return Data:

JSON 
[
  [
    "key1",
    "value1"
  ],
  [
    "key3",
    "value3"
  ]
]

remove_empty_value_from_array

Returns a filtered array that excludes all elements that are empty, null-like, or falsy.

Examples - remove_empty_value_from_array

EXAMPLE 1

Input:

CODE 
{{ ["a","b","","","c"] | remove_empty_value_from_array }}

Return Data:

JSON 
[
  "a",
  "b",
  "c"
]

EXAMPLE 2

Input:

CODE 
{{ [
  "D",
  "",
  None,
  null,
  Undefined,
  0,
  0.0,
  False,
  [],
  {},
  (),
  "3"
] | remove_empty_value_from_array }}

Return Data:

JSON 
[
  "D",
  "3"
]

reverse

Returns an array with the order of elements reversed.

Examples - reverse

EXAMPLE 1

Input:

CODE 
{% set array = ["a", "b", "c"] %}  
{{ array | reverse }}

Return Data:

JSON 
[
  "c",
  "b",
  "a"
]

EXAMPLE 2

Input:

CODE 
{% set array = [["a", "b"], ["c", "d"], ["e", "f"]] %}  
{{ array | reverse }}

Return Data:

JSON 
[
  [
    "e",
    "f"
  ],
  [
    "c",
    "d"
  ],
  [
    "a",
    "b"
  ]
]

EXAMPLE 3

Input:

CODE 
{% set array = [
  {"key1": "value1"},
  {"key2": "value2"},
  {"key3": "value3"}
] %}
{{ array | reverse }}

Return Data:

JSON 
[
  {
    "key3": "value3"
  },
  {
    "key2": "value2"
  },
  {
    "key1": "value1"
  }
]

selectattr(attribute, test, comparison)

Returns an array of objects from the input object array whose attribute values satisfy the specified test. A comparison value is required only when the test needs one. See the examples for details.

REJECTATTR VERSUS SELECTATTR

The rejectattr and selectattr filters are complementary opposites. See rejectattr.

Examples - selectattr

EXAMPLE 1

Input:

CODE 
{{ [
  {"value": -1},
  {"value": 0},
  {"value": 1},
  {"value": 2},
  {"value": 3}
] | selectattr("value", ">=", 1) }}

Return Data:

JSON 
[
  {
    "value": 1
  },
  {
    "value": 2
  },
  {
    "value": 3
  }
]

EXAMPLE 2

Input:

CODE 
{{ [
  {"value": 1},
  {"value": 2},
  {"value": 3},
  {"value": 4},
  {"value": 5}
] | selectattr("value", "lessthan", 2) }}

Return Data:

JSON 
[
  {
    "value": 1
  }
]

EXAMPLE 3

Input:

CODE 
{{ [
  {"value": 1},
  {"value": true},
  {"value": 0},
  {"value": false}
] | selectattr("value", "equalto", true) }}

Return Data:

JSON 
[
  {
    "value": 1
  },
  {
    "value": true
  }
]

EXAMPLE 4

Input:

CODE 
{{ [
  {"value": 1},
  {"value": true},
  {"value": 0},
  {"value": false}
] | selectattr("value", "sameas", true) }}

Return Data:

JSON 
[
  {
    "value": true
  }
]

EXAMPLE 5

Input:

CODE 
{{ [
  {"data": 1},
  {"data": 2},
  {"data": "three"},
  {"data": 4}
] | selectattr("data", "string") }}

Return Data:

JSON 
[
  {
    "data": "three"
  }
]

EXAMPLE 6

Input:

CODE 
{{ [
  {"data": 1},
  {"data": 2},
  {"data": "three"},
  {"data": 4}
] | selectattr("data", "number") }}

Return Data:

JSON 
[
  {
    "data": 1
  },
  {
    "data": 2
  },
  {
    "data": 4
  }
]

EXAMPLE 7

Input:

CODE 
{{ [
  {"num": 1.1},
  {"num": 2},
  {"num": 3.333}
] | selectattr("num", "float") }}

Return Data:

JSON 
[
  {
    "num": 1.1
  },
  {
    "num": 3.333
  }
]

EXAMPLE 8

Input:

CODE 
{{ [
  {"val": 1},
  {"val": "a"},
  {"val": 2.5},
  {"val": null}
] | selectattr("val", "integer") }}

Return Data:

JSON 
[
  {
    "val": 1
  }
]

EXAMPLE 9

Input:

CODE 
{{ [
  {"item": "text"},
  {"item": 1},
  {"item": 2.0},
  {"item": true}
] | selectattr("item", "boolean") }}

Return Data:

JSON 
[
  {
    "item": true
  }
]

EXAMPLE 10

Input:

CODE 
{{ [
  {"data": [1, 2]},
  {"data": (3, 4)},
  {"data": "text"},
  {"data": {"a": 1}},
  {"data": range(3)},
  {"data": 5},
  {"data": 3.14},
  {"data": true},
  {"data": null}
] | selectattr("data", "iterable") }}

Return Data:

JSON 
[{'data': [1, 2]}, {'data': (3, 4)}, {'data': 'text'}, {'data': {'a': 1}}, {'data': range(0, 3)}]

EXAMPLE 11

Input:

CODE 
{{ [
  {"data": {"a": 1}},
  {"data": [2, 3]},
  {"data": "string"}
] | selectattr("data", "mapping") }}

Return Data:

JSON 
[
  {
    "data": {
      "a": 1
    }
  }
]

EXAMPLE 12

Input:

CODE 
{{ [
  {"n": -3},
  {"n": -2},
  {"n": -1},
  {"n": 0},
  {"n": 1},
  {"n": 2},
  {"n": 3}
] | selectattr("n", "odd") }}

Return Data:

JSON 
[
  {
    "n": -3
  },
  {
    "n": -1
  },
  {
    "n": 1
  },
  {
    "n": 3
  }
]

EXAMPLE 13

Input:

CODE 
{{ [
  {"level": "low"},
  {"level": "medium"},
  {"level": "high"}
] | selectattr("level", "in", ["low","medium"]) }}

Return Data:

JSON 
[
  {
    "level": "low"
  },
  {
    "level": "medium"
  }
]

EXAMPLE 14

Input:

CODE 
{{ [
  {"num": 1},
  {"num": 2},
  {"num": 3},
  {"num": 4},
  {"num": 5}
] | selectattr("num", "divisibleby", 2) }}

Return Data:

JSON 
[
  {
    "num": 2
  },
  {
    "num": 4
  }
]

EXAMPLE 15

Input:

CODE 
{% set data = [
  ["key1","value1"],
  ["key2","value2"],
  ["key3","value3"]
] %}
{{ data | selectattr("1","equalto","value2") }}

Return Data:

JSON 
[
  [
    "key2",
    "value2"
  ]
]

sort

Returns a lexicographically sorted string array. DateTime strings are sorted chronologically. Supported DateTime formats include ODBC canonical (YYYY-MM-DD, YYYY/MM/DD, YYYY-MM-DD HH:mm:ss) and USA date formats (MM-DD-YYYY, MM/DD/YYYY, MM-DD-YYYY HH:mm:ss, MM/DD/YYYY HH:mm:ss).

USAGE ADVISORY

  • Expect the return data to be a string array, regardless of the original data types.

  • See Macros for Numeric Sorting to achieve true numeric ordering.

Examples - sort

EXAMPLE 1

Input:

CODE 
{{ [10, 3, 2, 1, 0] | sort }}

Return Data:

JSON 
[
  "0",
  "1",
  "10",
  "2",
  "3"
]

EXAMPLE 2

Input:

CODE 
{% set companies = ["Google", "Microsoft", "D3 Security", "Apple"] %}  
{{ companies | sort }}

Return Data:

JSON 
[
  "Apple",
  "D3 Security",
  "Google",
  "Microsoft"
]

EXAMPLE 3

Input:

CODE 
{{ [
  "2025-06-07",
  "06-09-2021",
  "2025-06-07 18:30:00",
  "06-08-2022",
  "2025-06-07 09:00:00"
] | sort }}

Return Data:

JSON 
[
  "06-09-2021",
  "06-08-2022",
  "2025-06-07",
  "2025-06-07 09:00:00",
  "2025-06-07 18:30:00"
]

EXAMPLE 4

Input:

CODE 
{{ ["v2.10", "v2.2", "v10.1"] | sort }}

Return Data:

JSON 
[
  "v10.1",
  "v2.10",
  "v2.2"
]

EXAMPLE 5

Input:

CODE 
{{ ["10.0.0.2", "10.0.0.10", "10.0.0.1"] | sort }}

Return Data:

JSON 
[
  "10.0.0.1",
  "10.0.0.10",
  "10.0.0.2"
]

EXAMPLE 6

Input:

CODE 
{{ ["1 a 1 b", "1 a 11 b", "10 a 2 b", "01 a 2 b"] | sort }}

Return Data:

JSON 
[
  "01 a 2 b",
  "1 a 1 b",
  "1 a 11 b",
  "10 a 2 b"
]

EXAMPLE 6

Input:

CODE 
{{ ["1a", "1A", "1@", "1-"] | sort }}

Return Data:

JSON 
[
  "1-",
  "1@",
  "1a",
  "1A"
]

EXAMPLE 7

Input:

CODE 
{{ ["1.5", "1.25", "1.75", "1.1"] | sort }}

Return Data:

JSON 
[
  "1.1",
  "1.25",
  "1.5",
  "1.75"
]
Macros for Numeric Sorting

Skip to the descending numeric sort.

Macro for Ascending Order Sort

CODE 
{% macro numeric_sort(array) %}
    {% set result = array[:] %}
    {% set length = result | count %}
    {% set ns = namespace(min_idx=0) %}
    {% for i in range(length) %}
        {% set ns.min_idx = i %}
        {% for j in range(i + 1, length) %}
            {% if (result[j] | float) < (result[ns.min_idx] | float) %}
                {% set ns.min_idx = j %}
            {% endif %}
        {% endfor %}
        {% if ns.min_idx != i %}
            {% set temp = result[i] %}
            {% set _ = result.__setitem__(i, result[ns.min_idx]) %}
            {% set _ = result.__setitem__(ns.min_idx, temp) %}
        {% endif %}
    {% endfor %}
    {{ result }}
{% endmacro %}

EXAMPLE 1

Input:

CODE 
{{ numeric_sort([ 1, 0, 10,]) }}

Return Data:

JSON 
[
  0,
  1,
  2,
  3,
  10
]

EXAMPLE 2

Input:

CODE 
{{ numeric_sort(["3", "-1", "2", "-2", "0"]) }}

Return Data:

JSON 
[
  "-2",
  "-1",
  "0",
  "2",
  "3"
]

EXAMPLE 3

Input:

CODE 
{{ numeric_sort(["3.1", "2.5", "2.49", "0.0", "-1.2"]) }}

Return Data:

JSON 
[
  "-1.2",
  "0.0",
  "2.49",
  "2.5",
  "3.1"
]

EXAMPLE 4

Input:

CODE 
{{ numeric_sort(["1", "3", "2", "3", "2", "1"]) }}

Return Data:

JSON 
[
  "1",
  "1",
  "2",
  "2",
  "3",
  "3"
]

EXAMPLE 5

Input:

CODE 
{{ numeric_sort(["3", "2.5", "1.0", "0", "-4.2", "10"]) }}

Return Data:

JSON 
[
  "-4.2",
  "0",
  "1.0",
  "2.5",
  "3",
  "10"
]

EXAMPLE 6

Input:

CODE 
{{ numeric_sort(["-0.5", "0.0001", "0.0", "-10.2", "2.1"]) }}

Return Data:

JSON 
[
  "-10.2",
  "-0.5",
  "0.0",
  "0.0001",
  "2.1"
]

EXAMPLE 7

Input:

CODE 
{{ numeric_sort(["1e2", "5e1", "2e3", "1.5e2"]) }}

Return Data:

JSON 
[
  "5e1",
  "1e2",
  "1.5e2",
  "2e3"
]

EXAMPLE 8

Input:

CODE 
{{ numeric_sort(["a", "-3", "2", "1"]) }}

Return Data:

JSON 
[
  "-3",
  "a",
  "1",
  "2"
]

READER NOTE

Non-numeric values are convert to 0.0 internally.

Macro for Descending Order Sort

CODE 
{% macro numeric_sort_desc(array) %}
    {% set result = array[:] %}
    {% set length = result | count %}
    {% set ns = namespace(max_idx=0) %}
    {% for i in range(length) %}
        {% set ns.max_idx = i %}
        {% for j in range(i + 1, length) %}
            {% if (result[j] | float) > (result[ns.max_idx] | float) %}
                {% set ns.max_idx = j %}
            {% endif %}
        {% endfor %}
        {% if ns.max_idx != i %}
            {% set temp = result[i] %}
            {% set _ = result.__setitem__(i, result[ns.max_idx]) %}
            {% set _ = result.__setitem__(ns.max_idx, temp) %}
        {% endif %}
    {% endfor %}
    {{ result }}
{% endmacro %}

EXAMPLE 1

Input:

CODE 
{{ numeric_sort_desc([ 1, 0, 10, 3, 2]) }}

Return Data:

JSON 
[
  10,
  3,
  2,
  1,
  0
]

EXAMPLE 2

Input:

CODE 
{{ numeric_sort_desc(["3", "-1", "2", "-2", "0"]) }}

Return Data:

JSON 
[
  "3",
  "2",
  "0",
  "-1",
  "-2"
]

EXAMPLE 3

Input:

CODE 
{{ numeric_sort_desc(["3.1", "2.5", "2.49", "0.0", "-1.2"]) }}

Return Data:

JSON 
[
  "3.1",
  "2.5",
  "2.49",
  "0.0",
  "-1.2"
]

EXAMPLE 4

Input:

CODE 
{{ numeric_sort_desc(["1", "3", "2", "3", "2", "1"]) }}

Return Data:

JSON 
[
  "3",
  "3",
  "2",
  "2",
  "1",
  "1"
]

EXAMPLE 5

Input:

CODE 
{{ numeric_sort_desc(["3", "2.5", "1.0", "0", "-4.2", "10"]) }}

Return Data:

JSON 
[
  "10",
  "3",
  "2.5",
  "1.0",
  "0",
  "-4.2"
]

EXAMPLE 6

Input:

CODE 
{{ numeric_sort_desc(["-0.5", "0.0001", "0.0", "-10.2", "2.1"]) }}

Return Data:

JSON 
[
  "2.1",
  "0.0001",
  "0.0",
  "-0.5",
  "-10.2"
]

EXAMPLE 7

Input:

CODE 
{{ numeric_sort_desc(["1e2", "5e1", "2e3", "1.5e2"]) }}

Return Data:

JSON 
[
  "2e3",
  "1.5e2",
  "1e2",
  "5e1"
]

EXAMPLE 8

Input:

CODE 
{{ numeric_sort_desc(["a", "-3", "2", "1"]) }}

Return Data:

JSON 
[
  "-3",
  "a",
  "1",
  "2"
]

READER NOTE

Non-numeric values are convert to 0.0 internally.

sort_natural

Returns an array of strings sorted in human-readable order. It divides each string into alternating unsigned (non-negative) integer and text (letters, punctuation, or symbols) segments, and compares them one by one in order of appearance until it finds a difference. Text segments are compared lexicographically, in a case-sensitive manner.

DateTime strings are sorted chronologically. ODBC canonical and USA date formats are supported.

USAGE ADVISORY

  • Expect the return data to be a string array, regardless of the original data types.

  • See Macros for Numeric Sorting to achieve true numeric ordering.

Examples - sort_natural

EXAMPLE 1

Input:

CODE 
{{ [10, 3, 2, 1, 0] | sort_natural }}

Return Data:

JSON 
[
  "0",
  "1",
  "2",
  "3",
  "10"
]

EXAMPLE 2

Input:

CODE 
{{ ["Google", "Microsoft", "D3 Security", "Apple"] | sort_natural }}

Return Data:

JSON 
[
  "Apple",
  "D3 Security",
  "Google",
  "Microsoft"
]

EXAMPLE 3

Input:

CODE 
{{ [
  "2025-06-07",
  "06-09-2021",
  "2025-06-07 18:30:00",
  "06-08-2022",
  "2025-06-07 09:00:00"
] | sort_natural }}

Return Data:

JSON 
[
  "06-09-2021",
  "06-08-2022",
  "2025-06-07",
  "2025-06-07 09:00:00",
  "2025-06-07 18:30:00"
]

EXAMPLE 4

Input:

CODE 
{{ ["v2.10", "v2.2", "v10.1"] | sort_natural }}

Return Data:

JSON 
[
  "v2.2",
  "v2.10",
  "v10.1"
]

EXAMPLE 5

Input:

CODE 
{{ ["10.0.0.2", "10.0.0.10", "10.0.0.1"] | sort_natural }}

Return Data:

JSON 
[
  "10.0.0.1",
  "10.0.0.2",
  "10.0.0.10"
]

EXAMPLE 6

Input:

CODE 
{{ ["1 a 1 b", "1 a 11 b", "10 a 2 b", "01 a 2 b"] | sort_natural }}

Return Data:

JSON 
[
  "1 a 1 b",
  "01 a 2 b",
  "1 a 11 b",
  "10 a 2 b"
]

EXAMPLE 6

Input:

CODE 
{{ ["1a", "1A", "1@", "1-"] | sort_natural }}

Return Data:

JSON 
[
  "1-",
  "1@",
  "1A",
  "1a"
]

EXAMPLE 7

Input:

CODE 
{{ ["1.5", "1.25", "1.75", "1.1"] | sort_natural }}

Return Data:

JSON 
[
  "1.1",
  "1.5",
  "1.25",
  "1.75"
]

sum(attribute, start)

Returns the total of all numeric values in an array, including the starting value (start, default 0). When an attribute is specified, it sums that attribute across all objects. Floating-point sums may show minor precision differences.

Examples - sum

EXAMPLE 1

Input:

CODE 
{{ [-3, -2, -1, 0, 1, 2] | sum }}

Return Data:

TEXT 
-3

EXAMPLE 2

Input:

CODE 
{{ [
  { 'a': 'z', 'd': 1 },
  { 'a': 'z', 'd': 1 + 1 }
] | sum(attribute='d') }}

Return Data:

TEXT 
3

EXAMPLE 3

Input:

CODE 
{{ [
  { 'analyst': 'Elon', 'tasks': 5 },
  { 'analyst': 'Sam', 'tasks': 4 }
] | sum(attribute='tasks', start=10) }}

Return Data:

TEXT 
19

EXAMPLE 4

Input:

CODE 
{{ [1.1, 2.2] | sum }}

Return Data:

TEXT 
3.3000000000000003

text_array_contains_text(search_text)

Returns True when the array of text values contains the specified search text. Returns False when no match exists or when the array contains only non-string values. A case-sensitive comparison is performed. Non-string elements are ignored. The search text is always interpreted as a string and must be quoted if it contains spaces or special characters.

Examples - text_array_contains_text

EXAMPLE 1

Input:

CODE 
{{ ['a', 'b'] | text_array_contains_text('a') }}

Return Data:

TEXT 
True

EXAMPLE 2

Input:

CODE 
{{ ['a', 'b'] | text_array_contains_text('c') }}

Return Data:

TEXT 
False

EXAMPLE 3

Input:

CODE 
{{ ['D3', 'Security'] | text_array_contains_text('security') }}

Return Data:

TEXT 
False

EXAMPLE 4

Input:

CODE 
{{ ['1', 2, '3'] | text_array_contains_text('2') }}

Return Data:

TEXT 
False

EXAMPLE 5

Input:

CODE 
{{ ['1', '2', '3'] | text_array_contains_text(2) }}

Return Data:

TEXT 
True

to_csv

Returns a CSV-format string generated from the piped input array. Trailing commas indicate empty cells for missing values. Column headers use object keys for object arrays, the index 0 for primitive arrays, and element index positions for arrays of arrays.

Examples - to_csv

EXAMPLE 1

Input:

CODE 
{% set arr = [
  {'x': 'B', 'y': 1},
  {'x': 'C', 'y': 2},
  {'x': 'D', 'y': 3}
] %}
{{ arr | to_csv }}

Return Data:

TEXT 
x,y
B,1
C,2
D,3

EXAMPLE 2

Input:

CODE 
{% set arr = [
  {'a':'A1','b':'B1','c':'C1','d':'D1','e':'E1'},
  {'a':'A2','b':'B2','c':'C2','d':'D2','e':'E2'}
] %}
{{ arr | to_csv }}

Return Data:

TEXT 
a,b,c,d,e
A1,B1,C1,D1,E1
A2,B2,C2,D2,E2

EXAMPLE 3

Input:

CODE 
{% set arr = ['x','null',true] %}
{{ arr | to_csv }}

Return Data:

TEXT 
0
x
null
True

EXAMPLE 4

Input:

CODE 
{% set arr = [
  ['X1','X2'],
  ['Y1','Y2'],
  ['Z1','Z2']
] %}
{{ arr | to_csv }}

Return Data:

TEXT 
0,1
X1,X2
Y1,Y2
Z1,Z2

EXAMPLE 5

Input:

CODE 
{% set arr = [
  ['X1','X2'],
  ['Y1','Y2'],
  ['Z1','Z2']
] %}
{{ arr | to_csv }}

Return Data:

TEXT 
0,1
X1,X2
Y1,Y2
Z1,Z2

to_list

Returns the input value wrapped in a list. A piped list input is returned unchanged.

Examples - to_list

EXAMPLE 1

Input:

CODE 
{{ "D3" | to_list }}

Return Data:

JSON 
[
  "D3"
]

EXAMPLE 2

Input:

CODE 
{{ 123 | to_list }}

Return Data:

JSON 
[
  123
]

EXAMPLE 3

Input:

CODE 
{{ { "D": "3" } | to_list }}

Return Data:

JSON 
[
  {
    "D": "3"
  }
]

EXAMPLE 4

Input:

CODE 
{{ ['D3', 'Security'] | to_list }}

Return Data:

JSON 
[
  "D3",
  "Security"
]

unique(is_case_sensitive)

Returns a new array containing only the unique elements of the input sequence, preserving their original order. If True is passed as a parameter, text comparison becomes case-sensitive. By default, the filter is case-insensitive and retains the first occurrence of each value. Comparison is based on value equality, respecting data type differences. Nested array and object elements are compared recursively for both structural and value equality.

Examples - unique

EXAMPLE 1

Input:

CODE 
{{ ['a', 'a', 'b', 'b', 'c', 'C'] | unique }}

Return Data:

JSON 
[
  "a",
  "b",
  "c"
]

EXAMPLE 2

Input:

CODE 
{{ ['a', 'a', 'b', 'b', 'c', 'C'] | unique(true) }}

Return Data:

TEXT 
[
  "a",
  "b",
  "c",
  "C"
]

EXAMPLE 3

Input:

CODE 
{{ [-1.1, 0.0, 1.1, 01.1, 1.10] | unique }}

Return Data:

JSON 
[
  -1.1,
  0.0,
  1.1
]

EXAMPLE 4

Input:

CODE 
{{ [[0, 2], [1, 2]] | unique }}

Return Data:

JSON 
[
  [
    0,
    2
  ],
  [
    1,
    2
  ]
]

EXAMPLE 5

Input:

CODE 
{{ [
  {'id': 1, 'value': 3.5},
  {'id': 1, 'value': 3.50},
  {'id': -1, 'value': 3.5},
  {'id': 2, 'value': 3.5}
] | unique }}

Return Data:

JSON 
[
  {
    "id": 1,
    "value": 3.5
  },
  {
    "id": -1,
    "value": 3.5
  },
  {
    "id": 2,
    "value": 3.5
  }
]

EXAMPLE 6

Input:

CODE 
{{ [
  {'x': {'y': [1, 2]}},
  {'x': {'y': [1, 2]}},
  {'x': {'y': [1, 3]}}
] | unique }}

Return Data:

JSON 
[
  {
    "x": {
      "y": [
        1,
        2
      ]
    }
  },
  {
    "x": {
      "y": [
        1,
        3
      ]
    }
  }
]

update_key_names([old_key,new_key]…[old_key,new_key])

Returns an updated object array in which specified key names are replaced with new key names. The old key name must exist in every object being processed, and the new key name must not exist in an object at the time its rename is performed. Rename pairs and collision checks are applied sequentially.

Examples - update_key_names

EXAMPLE 1

Input:

CODE 
{% set arr = [
  {"v": null, "x": "X1", "y": "Y1", "z": "Z1"},
  {"v": "W2", "x": "X2", "y": "Y2", "z": "Z2"}
] %}
{{ arr | update_key_names(['v','w']) }}

Return Data:

JSON 
[
  {
    "x": "X1",
    "y": "Y1",
    "z": "Z1",
    "w": null
  },
  {
    "x": "X2",
    "y": "Y2",
    "z": "Z2",
    "w": "W2"
  }
]

EXAMPLE 2

Input:

CODE 
{% set arr = [
  {"v": null, "u": "X1", "y": "Y1", "z": "Z1"},
  {"v": "W2", "u": "X2", "y": "Y2", "z": "Z2"}
] %}
{{ arr | update_key_names(['v','w'],['u','x']) }}

Return Data:

JSON 
[
  {
    "y": "Y1",
    "z": "Z1",
    "w": null,
    "x": "X1"
  },
  {
    "y": "Y2",
    "z": "Z2",
    "w": "W2",
    "x": "X2"
  }
]

EXAMPLE 3

Input:

CODE 
{% set arr = [
  {"x": null, "u": "X1", "y": "Y1", "z": "Z1"},
  {"x": "W2", "u": "X2", "y": "Y2", "z": "Z2"}
] %}
{{ arr | update_key_names(['x','w'],['u','x']) }}

Return Data:

JSON 
[
  {
    "y": "Y1",
    "z": "Z1",
    "w": null,
    "x": "X1"
  },
  {
    "y": "Y2",
    "z": "Z2",
    "w": "W2",
    "x": "X2"
  }
]

where(test, comparator)

Returns an array containing elements from the piped input sequence that pass the specified test. The second parameter is only required for tests that need a comparator.

WHERE VERSUS REJECT

The where and reject filters are complementary opposites. See reject.

Examples - where

EXAMPLE 1

Input:

CODE 
{{ [-1, 0, 1, 2, 3] | where(">=", 1) }}

Return Data:

JSON 
[
  1,
  2,
  3
]

EXAMPLE 2

Input:

CODE 
{{ [1, 2, 3, 4, 5] | where("lessthan", 2) }}

Return Data:

JSON 
[
  1
]

EXAMPLE 3

Input:

CODE 
{{ [1, True, 0, False] | where("equalto", True) }}

Return Data:

JSON 
[
  1,
  true
]

EXAMPLE 4

Input:

CODE 
{{ [1, True, 0, False] | where("sameas", True) }}

Return Data:

JSON 
[
  true
]

EXAMPLE 5

Input:

CODE 
{{ [1, 2, "three", 4] | where("string") }}

Return Data:

JSON 
[
  "three"
]

EXAMPLE 6

Input:

CODE 
{{ [1, 2, "three", 4] | where("number") }}

Return Data:

JSON 
[
  1,
  2,
  4
]

EXAMPLE 7

Input:

CODE 
{{ [1.1, 2, 3.333] | where("float") }}

Return Data:

JSON 
[
  1.1,
  3.333
]

EXAMPLE 8

Input:

CODE 
{{ [1, "a", 2.5, null] | where("integer") }}

Return Data:

JSON 
[
  1
]

EXAMPLE 9

Input:

CODE 
{{ ["text", 1, 2.0, True] | where("boolean") }}

Return Data:

JSON 
[
  true
]

EXAMPLE 10

Input:

CODE 
{{ [
  [1, 2],
  (3, 4),
  "text",
  {"a": 1},
  range(3),
  5,
  3.14,
  True,
  None
] | where("iterable") }}

Return Data:

JSON 
[[1, 2], (3, 4), 'text', {'a': 1}, range(0, 3)]

EXAMPLE 11

Input:

CODE 
{{ [{"a":1}, [2,3], "string"] | where("mapping") }}

Return Data:

JSON 
[
  {
    "a": 1
  }
]

EXAMPLE 12

Input:

CODE 
{{ [-3, -2, -1, 0, 1, 2, 3] | where("odd") }}

Return Data:

JSON 
[
  -3,
  -1,
  1,
  3
]

EXAMPLE 13

Input:

CODE 
{{ ["low", "medium", "high"] | where("in", ["low", "medium"]) }}

Return Data:

JSON 
[
  "low",
  "medium"
]

EXAMPLE 14

Input:

CODE 
{{ [1, 2, 3, 4, 5] | where("divisibleby", 2) }}

Return Data:

JSON 
[
  2,
  4
]

RELATED ARTICLES

JavaScript errors detected

Please note, these errors can depend on your browser setup.

If this problem persists, please contact our support.

Contact Support Close