Function Traits and Arguments

Functions within LogScale are identified by their trait which provides an indication of what operation the function performs on the event stream. For more information, see Function Traits.

Function Traits

Individual functions have certain traits which indicate the type of operation or effect on the event stream they have. These traits both describe their effect, but also indicate compatibility between different functions. For example the window() accepts aggregate functions as the value to the name argument.

  • Aggregate

    Collects and summarize data. Combines events into new results — often a single number or row.

    Example:

    logscale
    groupBy([protocol])

  • BucketBuildingAggregate

    Builds a summary of events organized by buckets according to the time of the event.

    Example:

    logscale
    bucket(1min, field=status_code, function=count())

  • EventSelectingAggregate

    Returns a summarized list of events.

    Example:

    logscale
    head(10)

  • FieldComputationFunction

    Performs a calculation or computation returning the information as a field in the event stream.

    Example:

    logscale
    formattime("%A %d %B %Y, %R", as=fmttime, field=@timestamp, timezone=PST)

  • Filter

    Filters the events.

    Example:

    logscale
    regex(regex="/user/(?<userid>\\S+)/pay", field=url)

  • Negatable

    Events can be negated (prefixed with a !).

    Example – show events that have status with a value of 422 or 200:

    logscale
    in(status, values=["422","200"])

    To negate the operation:

    logscale
    !in(status, values=["404","500"])

    This includes events that don't have the quoted values of 404 or 500.

  • Transformation

    Transforms the value of a field within each event and may add, remove or modify fields.

    Example:

    logscale
    concat([field1,"/",field2], as=combined)

  • WithInputField

    Uses the value of another field to influence the output of field transformation.

    Example:

    logscale
    in(status, values=["422","200"])

It's possible for more than one trait to apply to a function, for example in() is both a filter and negatable.