Collects fields from multiple events into one event. It has a limit of 1Kb per key when used as part of a groupBy() operation. This limits the number of values you can index during the aggregation.

ParameterTypeRequiredDefault ValueDescription
fields[a]Array of stringsrequired  Names of the fields to keep.
limitintegeroptional[b]2000 Limit to number of distinct values in collect.
  Minimum1 
multivalbooleanoptional[b]true Collects the resulting value as multivalue (a single field value using separator).
separatorstringoptional[b]\n Separator used for multiple values.

[a] The argument name fields can be omitted.

[b] Optional parameters use their default value unless explicitly set.

Hide omitted argument names for this function

Show omitted argument names for this function

collect() Examples

Collects visitors, each visitor defined as non-active after one minute.

logscale
groupby(client_ip, function=session(maxpause=1m, collect([url])))

Collect fields from multiple events, counting the collected field:

logscale
LocalAddressIP4 = * RemoteAddressIP4 = * aip = *
| groupBy([LocalAddressIP4, RemoteAddressIP4], function=([count(aip, as=aipCount, distinct=true), collect([aip])]))