Aggregate query functions are used to summarize event data during a query. Aggregation simplifies an event set and provides both a shorter set of events and reduces the processing load when querying the event set. For example, when searching for specific events, the events may be summarized by their type or class. By reducing the event data later, parts of the query can be processed more efficiently.

Aggregation is also used when examining trends and finding patterns and creating sets of data suitable for displaying through a widget such as a bar chart or sankey diagram. For some functions and queries, an aggregate function must be used to summarize the data before it is processed.

Aggregate functions combine multiple event values into a summarized single value and/or grouped values, reducing many data points into key metrics that can be used for further manipulation, analyzation and visualization. For example, the groupBy() function summarizes data by one or more fields, and then provides a summary value for that group, such as count, sum, average, minimum, or maximum for all rows in a column or table as defined by the query.

Some functions (for example visualization functions or analysis functions) need summarized or grouped data to create meaningful widgets or to simplify the processing of the incoming data. Processing millions of individual events would create a significant load on the system for relatively small values. For more efficient querying, aggregation creates a smaller set of data on which to perform more intensive processing.

As an example, you must group the data first using aggregate functions like groupBy() or bucket() if you are trying to:

Examples of functions used for visualization could be timeChart() and sankey().

Examples of functions used for analysis could be percentage(), top() and sort().

Sequence functions must also come after an aggregator function (for example, bucket(), head(), sort()) to provide a meaningful order to the events. Order matters in query construction.

In some cases, if a query is defined so that it requires an aggregate data set, a warning will be generated by LogScale to indicate the aggregate query requirement. For example:

The partition() function must come after an aggregator. E.g. groupBy(), bucket(), sort(), tail(), or head().

For some functions used during a query, the argument used must be an aggregate function. For example, the partition() function splits a sequence of events into multiple sequences, using an aggregate function to identify each partition.

Using aggregate functions as arguments enables dynamic calculations and data-driven analysis based on your data patterns. The aggregate functions calculate a value such as count, sum, average, minimum, or maximum for all rows in a column or table as defined by the query.

In some cases, multiple aggregates can be used together and also be nested for advanced calculations.

As an example, with groupBy() you can specify multiple aggregate functions so that the grouped event set contains minimum, maximum and average values for each group.