Skip to main content
Use the bag_pack function in APL to construct a dynamic property bag from a list of key-value pairs. A property bag is a flexible data structure where keys are strings and values are dynamic types. This function is useful when you want to combine multiple values into a single dynamic object, often to simplify downstream processing or export. You typically use bag_pack in projection scenarios to consolidate structured data—for example, packing related request metadata into one field, or grouping trace data by contextual attributes. This makes it easier to output, filter, or transform nested information.
The pack and bag_pack functions are equivalent in APL.A common use is bag_pack(*) that gets all fields of your dataset as a bag. This can be useful when you want to get sets of values.

​
For users of other query languages

If you come from other query languages, this section explains how to adjust your existing queries to achieve the same results in APL.
In Splunk, you can use mvzip and eval to create key-value mappings, or use spath to interpret JSON data. However, packing data into a true key-value structure for export or downstream use requires JSON manipulation. APL’s bag_pack provides a native and type-safe way to do this.
| eval metadata=tojson({"status": status, "duration": req_duration_ms})
SQL doesn’t have a direct built-in function like bag_pack. To achieve similar behavior, you typically construct JSON objects using functions like JSON_OBJECT or use user-defined types. In APL, bag_pack is the idiomatic way to construct dynamic objects with labeled fields.
SELECT JSON_OBJECT('status' VALUE status, 'duration' VALUE req_duration_ms) AS metadata FROM logs;

​
Usage

​
Syntax

bag_pack(key1, value1, key2, value2, ...)

​
Parameters

NameTypeDescription
key1, key2, ...stringThe names of the fields to include in the property bag.
value1, value2, ...scalarThe corresponding values for the keys. Values can be of any scalar type.
The number of keys must equal the number of values. Keys must be string literals or string expressions.

​
Returns

A dynamic value representing a property bag (dictionary) where keys are strings and values are the corresponding values.

​
Use case examples

  • Log analysis
  • OpenTelemetry traces
  • Security logs
Use bag_pack to create a structured object that captures key request attributes for easier inspection or export.Query
['sample-http-logs']
| where status == '500'
| project _time, error_context = bag_pack('uri', uri, 'method', method, 'duration_ms', req_duration_ms)
Run in PlaygroundOutput
_timeerror_context
2025-05-27T10:00:00Z{ "uri": "/api/data", "method": "GET", "duration_ms": 342 }
2025-05-27T10:05:00Z{ "uri": "/api/auth", "method": "POST", "duration_ms": 879 }
The query filters HTTP logs to 500 errors and consolidates key request fields into a single dynamic column named error_context.
  • bag_keys: Returns all keys in a dynamic property bag. Use it when you need to enumerate available keys.
  • bag_has_key: Checks whether a dynamic property bag contains a specific key.