replace

Description

The replace command overwrites the value of an existing keypath with the result of a new expression. It is often used to clean or transform existing values while maintaining the same document structure.

This is particularly helpful for decoding, normalizing, or updating data fields without creating new keys.

Syntax

replace <keypath> with <expression>

Example

Use case: Decode URL-encoded query parameters

Suppose you have a nested field containing URL-encoded values. You can use replace with a decoding function to update the existing keypath directly.

Example data

{
  "domain": "https://www.coralogix.com",
  "query_string": "a=b&b=c&c=d",
  "path": "/home",
  "query_string_parameters": {
    "name": "Tom%20Kosman",
    "b": "c",
    "c": "d"
  }
}

Example query

replace query_string_parameters.name with query_string_parameters.name.urlDecode()

Example output

{
  "domain": "https://www.coralogix.com",
  "query_string": "a=b&b=c&c=d",
  "path": "/home",
  "query_string_parameters": {
    "name": "Tom Kosman",
    "b": "c",
    "c": "d"
  }
}

The replace command applies the transformation defined in the expression and updates the specified keypath in place. The original encoded value is replaced with its decoded equivalent.