Tabular Operators

project operator

Select the Fields to insert, rename, include or drop, and embed new computed columns.

Syntax

| project ColumnName [= Expression] [, ...]
| project FieldName, FieldName, FieldName, ...

or

| project [FieldName, FieldName[,] = Expression [, ...]

Arguments

nametypedescription
Field Name(Column Name)stringName of a Field (column) to appear in the output. If there is no Expression, then Field Name is compulsory and a column of that name must appear in the input
ExpressionexpressionOptional scalar expression referencing the input columns.

Returns

A table that has the Field named as arguments, and as many rows as the input table.

Example

['http-logs']
| project ['geo.country'] = ['id']
['http-logs']
| project ['geo.country'] = ['id'], method = ['geo.city']
['http-logs']
| project ['geo.city'], content_type, ['geo.country'], ['id'], is_tls