Skip to main content
Use the bag_merge function in APL (Axiom Processing Language) to merge two or more dynamic (JSON-like) bags into a single dynamic value. This function is useful when you want to aggregate multiple properties from different sources or rows into one unified structure. The function is especially valuable in scenarios involving flexible schemas, such as semi-structured log or trace data, where each record might contain partial metadata that you want to consolidate. Use bag_merge to combine dynamic values across groups or time ranges. When multiple input bags share the same property name, bag_merge returns the last one by default, replacing earlier ones.
bag_merge is currently in private preview. To try it out, contact Axiom.

​
For users of other query languages

If you come from other query languages, this section explains how to adjust your existing queries to achieve the same results in APL.
In Splunk, you use spath, mvcombine, or eval with json_object and json_merge-style logic to work with JSON objects. APL’s bag_merge provides a simpler and more direct way to merge dynamic values (bags) across rows or groups.
| stats values(field1) as field1_values values(field2) as field2_values 
| eval merged=json_object("field1", field1_values, "field2", field2_values)
ANSI SQL doesn’t have a built-in equivalent to APL’s bag_merge because it lacks native support for dynamic (JSON-like) objects and merging them. You often need to write complex expressions using JSON_OBJECT, JSON_MERGE, or user-defined functions. APL handles this use case natively with bag_merge.
SELECT JSON_OBJECT_AGG(key, value)
FROM (
  SELECT 'a' AS key, '1' AS value
  UNION
  SELECT 'b', '2'
) t

​
Usage

​
Syntax

bag_merge(Bag1, Bag2, Bag3, ...)

​
Parameters

NameTypeDescription
Bag1, Bag2, ...dynamicThe bags you want to merge.

​
Returns

A single dynamic value that merges all bags in the group. If the same key appears in multiple bags, the value from the last bag takes precedence.

​
Use case examples

  • Log analysis
  • OpenTelemetry traces
  • Security logs
Combine metadata from multiple logs for each user into a single object to simplify downstream analysis.Query
['sample-http-logs']
| project id, metadata = pack('uri', uri, 'status', status, 'method', method)
| summarize merged_metadata = bag_merge(metadata) by id
Output
idmerged_metadata
user1{'uri': '/home', 'status': '200', 'method': 'GET'}
user2{'uri': '/cart', 'status': '404', 'method': 'POST'}
Each row shows merged HTTP metadata for each unique user.
  • bag_has_key: Checks whether a dynamic property bag contains a specific key.
  • bag_keys: Returns all keys in a dynamic property bag. Use it when you need to enumerate available keys.
  • bag_pack: Converts a list of key-value pairs to a dynamic property bag. Use when you need to build a bag.