Aggregate Query Functions
LogScale's aggregate query functions take a set of events, parameters, or configurations; and produce, reduce, or modify values within that set, or within the events themselves within the query pipeline.
Table: Array Query Functions
| Function | Implied Argument | Availability | Description |
|---|---|---|---|
avg([as], field) | field | Calculates the average for a field of a set of events. | |
bucket([buckets], [field], [function], [limit], [minSpan], [span], [timezone], [unit]) | span | Extends the groupBy function for grouping by time. | |
callFunction([as], field, function) | function | Calls the named function on a field over a set of events. | |
collect(fields, [limit], [multival], [separator]) | fields | Collects fields from multiple events into one event. | |
count([as], [distinct], [field]) | field | Counts given events. | |
counterAsRate([as], field) | field | Calculates the rate for a counter field. | |
groupBy(field, [function], [limit]) | field | Groups events by specified fields and executes aggregate functions on each group. | |
head([limit]) | limit | Returns the oldest events. | |
holtwinters([alpha], [beta], [gamma], period) | period | deprecated in 1.73 | Used to generate a trendline for a periodic dataset. |
linReg([prefix], x, y) | linreg | Computes linear relationship model between two variables using least-squares fitting. | |
selectFromMax(field, include) | Selects event with the largest value for the specified field. | ||
selectFromMin(field, include) | Selects event with the smallest value for the specified field. | ||
selectLast(fields) | fields | Specify fields to select from events, keeping value of most recent event for each field. | |
series(collect, [endmatch], [maxduration], [maxpause], [memlimit], [separator], [startmatch]) | collect | Collects a series of values for selected fields from multiple events into one or more events. | |
sort([field], [limit], [order], [reverse], [type]) | field | Sorts events by their fields. | |
sum([as], field) | field | Calculates the sum for a field over a set of events. | |
top([as], [error], field, [limit], [max], [percent], [rest], [sum]) | field | Finds the top results based on a given field. | |
window([buckets], [function], [span]) | function | Computes aggregate functions over a sliding window of data. |