The table() function displays query results in a table. It specifies a list of fields to select.

The table() function is an aggregate function and does as follows:

  • Sorts columns in the table based on specified field order.
  • Aggregates events based on the limit parameter. It will limit the number of events returned using the limit parameter.
  • Sorts results according to the sortby parameter.

For large data exports, consider using the select() function instead. The select() function provides similar tabular output but without row limits or sorting constraints.

ParameterTypeRequiredDefault ValueDescription
fields[a]array of stringsrequired   The names of the fields to select.
limitnumberoptional[b]   The argument given to this parameter determines the limit on the number of rows included in the result of the function. The default argument is default. The maximum is controlled by the StateRowLimit dynamic configuration, which is StateRowLimit by default. If the argument is max (limit=max), then the value of StateRowLimit is used.
  Maximum20,000The default maximum limit is not static and can be changed by setting the StateRowLimit dynamic configuration.
orderarray of stringsoptional[b] desc Order to sort in.
   Valid Values
   ascAscending (A-Z, 0-9) order
   descDescending (Z-A, 9-0) order
reversebooleanoptional[b]   Whether to sort in descending order. Deprecated: prefer order instead.
sortbyarray of stringsoptional[b] @timestamp Names of fields to sort by.
typearray of stringsoptional[b] number Type of the fields to sort.
   Valid Values
   anyAny fields. From version 1.125, this value is deprecated. (deprecated in 1.125.0)
   hexHexadecimal fields
   numberNumerical fields
   stringString fields

[a] The parameter name fields can be omitted.

[b] Optional parameters use their default value unless explicitly set.

Hide omitted argument names for this function

Show omitted argument names for this function

table() Syntax Examples

Create a table of HTTP GET methods displaying the fields statuscode and responsetime:

logscale
method=GET
| table([statuscode, responsetime])

Display the 50 slowest requests by name and responsetime:

logscale
table([name, responsetime], sortby=responsetime, limit=50, order=asc)