Collects fields from multiple events into one event.

Function Traits: Aggregate

ParameterTypeRequiredDefaultDescription
fields[a]Array of stringsrequired  Names of the fields to keep.
limitnumberoptional2000 Limit to number of distinct values in collect.
multivalbooleanoptionaltrue Collects the resulting value as multivalue (a single field value using separator).
separatorstringoptional\n Separator used for multiple values.

[a] The argument name fields can be omitted.

The parameter name for fields can be omitted; the following forms are equivalent:

logscale
collect("value")

and:

logscale
collect(fields="value")

The collect() has a limit of 1Kb per key when usedd as part of a groupBy() operation. This limits the number of values you can index during the aggregation.

The collect() function is limited in the memory for while collecting data before the data is aggregated. The limit changes depending on whether collect() runs as a top level function — in which case its limit is 10 MiB:

logscale
#type = humio #kind=logs
| collect(myField)

or whether it runs in a subquery, or as a sub-aggregator to another function — in which case its limit is 1 MiB:

logscale
#type = humio #kind=logs
 groupBy(myField, function=collect(myOtherField))

collect() Examples

Collects visitors, each visitor defined as non-active after one minute.

logscale
groupby(client_ip, function=session(maxpause=1m, collect([url])))