Skip to content
This is an archived version of the documentation downloaded from LogScale Documentation Archives. Up to date documentation, and documentation for later versions, is available on LogScale Documentation

## Function Syntax

LogScale query functions process event data by producing, reducing, or modifying values within query pipelines, with support for both built-in functions and user-created functions through saved queries. The documentation covers function syntax including composite function calls, user functions with arguments, link functions for creating clickable results, and repeating queries that execute at regular intervals for dashboards and alerts.

LogScale query functions take a set of events, parameters, or configurations. From this, they produce, reduce, or modify values within that set, or in the events themselves within a query pipeline. LogScale has many built-in query functions. They are listed and described in the Query Functions section.

### Composite Function Calls

Whenever a function accepts a function as an argument, there are some special rules. For all variations of `groupBy()`, `bucket()` and `timeChart()`, that take a function= argument, you can also use a composite function. Composite functions take the form `{ f1(..) | f2(..) }` which works like the composition of `f1` and `f2`. For example, you can do:

logscale Syntax

    groupBy(type, function={ avgFoo := avg(foo)
    | outFoo := round(avgFoo) })

You can also use filters inside such composite function calls, but not saved queries.

Incidentally, queries can contain Comments. This is useful for long multi-line queries and especially with saved queries, since later, you may not remember the purpose of each step. Below is an example of a comment embedded in a query:

logscale

    #type=accesslog // choose the type
    | top(url)  // count urls and choose the most frequently used

### Link Functions

When showing search results in a table it is possible to create a link that is clickable. If the value of a field looks like a link, the UI will make it clickable. Links can be constructed using the search language. The `format()` function can be handy for this.

logscale

    $extractRepo()
    | top(repo)
    | format("https://example.com/%s", field=repo, as=link)

For further clarity, you can use Markdown formatting to give the link a title:

logscale

    $extractRepo()
    | top(repo)
    | format("[Link](https://example.com/%s)", field=repo, as=link)

### Repeating Queries

Some functions have limitations around their use in live queries, such as `join()` — see `beta:repeating()` and `selfJoin()`.

A repeating query is a static query that is executed at regular intervals and can be used in the same places as live queries, such as in dashboards or alerts.

You can turn a live query into a repeating by adding the `beta:repeating()` function to the query. For example, this query will be repeated every 10 minutes and can be used in dashboards and alerts:

logscale

    selfJoin(field=email_id, where=[{from=peter},{to=anders}])
    | beta:repeating(10m)

Using `beta:repeating()` in a static query is allowed, but has no effect.

#### Enabling Repeating Queries

Repeating queries are in beta. In order to use repeating queries, you must enable them by making the following GraphQL mutation as root from the API explorer found at `$$YOUR_LOGSCALE_URL/docs/api-explorer`:

graphql

    mutation {
      enableFeature(feature: RepeatingQueries)
    }

If this feature is disabled later, then any alert, dashboard, or saved query using `beta:repeating()` in the query will not function.

#### Enter search term