Count Events per Repository
Count of the events received by repository
Query
logscale
bucket(span=1d,field=#repo,function=count())
| @timestamp:=_bucket
| drop(_bucket)
Introduction
Count of X events received by a repo (Cloud).
Step-by-Step
Starting with the source repository events.
- flowchart LR; %%{init: {"flowchart": {"defaultRenderer": "elk"}} }%% repo{{Events}} 0{{Aggregate}} 1[\Update Field Data\] 2[/Drop Field\] result{{Result Set}} repo --> 0 0 --> 1 1 --> 2 2 --> result style 1 fill:#ffbf00; style 2 fill:#2ac76d; click 2 #examples-events-count-repo-2 style 0 fill:#ff0000,stroke-width:4px,stroke:#000;logscale
bucket(span=1d,field=#repo,function=count())
- flowchart LR; %%{init: {"flowchart": {"defaultRenderer": "elk"}} }%% repo{{Events}} 0{{Aggregate}} 1[\Update Field Data\] 2[/Drop Field\] result{{Result Set}} repo --> 0 0 --> 1 1 --> 2 2 --> result style 1 fill:#ffbf00; style 2 fill:#2ac76d; click 2 #examples-events-count-repo-2 style 1 fill:#ff0000,stroke-width:4px,stroke:#000;logscale
| @timestamp:=_bucket
Updates the timestamp to the value generated by the
bucket()
- flowchart LR; %%{init: {"flowchart": {"defaultRenderer": "elk"}} }%% repo{{Events}} 0{{Aggregate}} 1[\Update Field Data\] 2[/Drop Field\] result{{Result Set}} repo --> 0 0 --> 1 1 --> 2 2 --> result style 1 fill:#ffbf00; style 2 fill:#2ac76d; click 2 #examples-events-count-repo-2 style 2 fill:#ff0000,stroke-width:4px,stroke:#000;logscale
| drop(_bucket)
Discards the _bucket field from the results.
Event Result set.
Summary and Results
The query can be run on each repo. Or, create a view that looks across multiple repos and then run it from there to get all the repo counts in one search.