multi-project
multi-project
The multi-project operator expands each input row into multiple output rows using a set of templated projections. It is useful when you need to fan out one record into several derived records while keeping full control over the output schema.
Syntax
| multi-project ( <column-name> : <column-type> [, ...] ) [ <column-expr>, ... ] Parameters
<column-name>: The name of an output column.<column-type>: The data type of the output column (e.g.,string,int64,datetime).<column-expr>: An expression that produces the value for the corresponding column. Expressions may reference columns from the input stream or constants.
Return Value
For each input row, multi-project outputs one row per templated set of expressions. The resulting table has only the columns defined in the multi-project column list.
Notes
- The number of expressions in each templated row must match the number of columns declared.
- Each templated row is evaluated independently per input row; if you define N templates and the input has M rows, the output will have M × N rows.
- Column types are validated against the expressions at parse time.
Examples
Example 1: Expand each row into multiple stages
datatable (User:string, EventCount:int64)
[
"alice", 3,
"bob", 2
]
| multi-project (Stage:string, CountDelta:int64) [
"pre", EventCount - 1,
"post", EventCount + 1
] | Stage | CountDelta |
|---|---|
| pre | 2 |
| post | 4 |
| pre | 1 |
| post | 3 |
Example 2: Duplicate rows with transformed values
datatable (Timestamp:datetime, Message:string)
[
datetime(2024-01-01), "Started"
]
| multi-project (Event:string, Occurred:datetime) [
strcat("raw_", Message), Timestamp,
strcat("normalized_", tolower(Message)), Timestamp + time(1h)
] This produces two rows per input record: one with the original message and one with a normalized variant an hour later.