Subquery Syntax

The use of subqueries, and their capabilities are also related to the context of the query. Not all contexts support subqueries, and some subqueries may imply a specific context.

Subqueries generally fall into one of the following categories:

  • Filter Query

    A filter query is a combination of syntax or functions that only filter the event set or modify the values as part of processing. It typically does not include aggregating functions.

  • Non-aggregate Query

    Any query that does not include an aggregate function.

  • Aggregate Query

    A query that explicitly includes aggregating functions to produce an aggregate event set.

A subquery can be a single expression or part of an array of expressions depending on the function. To declare a subquery, use braces to enclose the query. For example:

logscale
array:filter(array="agents[]", function={bname=/\//}, var="bname")

In this example, {bname=/\//} is a subquery that filters array elements based on a regular expression pattern.